DOE O 5480.23 Chg 1, Nuclear Safety Analysis Reports

DOE O 5480.23 U.S. Department of Energy ORDER Washington, D.C. 4-10-92 SUBJECT: NUCLEAR SAFETY ANALYSIS REPORT Effective Date: 4-30-92 DISTRIBUTION: INITIATED BY: All Departmental Elements The Office of Human Resources and Administration 1. PURPOSE. To establish requirements for contractors responsible for the design, construction, operation, decontamination, or decommissioning of nuclear facilities to develop safety analyses that establish and evaluate the adequacy of the safety bases of the facilities. The Nuclear Safety Analysis Report (SAR) required by this Order documents the results of the safety analysis. 2. CANCELLATIONS. a. DOE 5480.5, Paragraphs 5l, 7b(3), 7b(4), 7e(3), 8a, and 8h, SAFETY OF NUCLEAR FACILITIES, of 9-23-86. b. DOE 5480.6, Paragraphs 7b(3), 7e(3), and 8c, SAFETY OF DEPARTMENT OF ENERGY-OWNED REACTORS, of 9-23-86. c. DOE 5481.1B, SAFETY ANALYSIS AND REVIEW SYSTEMS (for nuclear facilities), of 9-23-86. 3. SCOPE. The provisions of this Order apply to all Departmental Elements and to covered contractors to the extent implemented under a contract or other agreement. A covered contractor is a seller of supplies or services, involving a DOE-owned or - leased nuclear facility, under a contract or subcontract containing one of four contract clauses as follows: (1) Safety and Health (Government-owned or -leased facility) [DEAR 970.5204-2]; (2) Nuclear Facility Safety [DEAR 970.5204-26]; (3) Radiation Protection and Nuclear Criticality [DEAR 952.223-72]; or (4) another clause whereby DOE elects to require compliance with DOE nuclear safety requirements. The provisions of this Order will be applied to DOE-owned nuclear facilities and operations, excluding: (a) those subject to Nuclear Regulatory Commission (NRC) licensing; and (b) those facilities and activities conducted under Executive Order 12344 and Public Law 98-525; and (c) activities conducted under Section 91 of the Atomic Energy Act of 1954 as amended. 4. REFERENCES. a. DOE 1324.2A, RECORDS DISPOSITION, of 9-13-88, which establishes the Departmental records disposition program. 2 DOE 5480.23 4-10-92 b. DOE 3790.1A, FEDERAL EMPLOYEE OCCUPATIONAL SAFETY AND HEALTH PROGRAM, of 10-22-84, which establishes the policy and requirements for the occupational safety and health program for Federal employees. c. DOE 4700.1, PROJECT MANAGEMENT SYSTEM, of 3-6-87, which establishes the principles and requirements that govern the development, approval, and execution of the DOE Project Management System. d. DOE 5000.3A, OCCURRENCE REPORTING AND UTILIZATION OF OPERATIONS INFORMATION, of 5-30-90, which establishes reporting of unusual occurrences with programmatic significance for DOE operations. e. DOE 5480.3, SAFETY REQUIREMENTS FOR THE PACKAGING AND TRANSPORTATION OF HAZARDOUS MATERIALS, HAZARDOUS SUBSTANCES, AND HAZARDOUS WASTES, of 7-9-85, which establishes the subject requirements. f. DOE 5480.5, SAFETY OF NUCLEAR FACILITIES, of 9-23-86, which establishes DOE's nonreactor nuclear facility safety program. g. DOE 5480.6, SAFETY OF DEPARTMENT OF ENERGY-OWNED NUCLEAR REACTORS, of 9-23-86, which establishes DOE's nuclear reactor safety program. h. DOE 5480.22, TECHNICAL SAFETY REQUIREMENTS, of 2-25-92, which establishes DOE's nuclear facility technical safety requirements. i. DOE 5480.10 CONTRACTOR INDUSTRIAL HYGIENE PROGRAM, of June 6, 1985, which establishes requirements and guidelines applicable to DOE contract operations for maintaining an effective industrial hygiene program.

j. DOE 5480.21 UNREVIEWED SAFETY QUESTIONS, of 12-24-91, which establishes the means by which Unreviewed Safety Questions (USQ's) are identified and the means of resolution of USQ's. k. DOE 5480.11, RADIATION PROTECTION FOR OCCUPATIONAL WORKERS, of 12-21-88, which establishes radiation protection standards and program requirements to protect workers from ionizing radiation. l. DOE 5610.1, PACKAGING AND TRANSPORTING OF NUCLEAR EXPLOSIVES, NUCLEAR COMPONENTS, AND SPECIAL ASSEMBLIES, of 9-11-79, which establishes safety policies and procedures applicable to packaging and transportation of nuclear DOE 5480.23 Chg 1 3 3-10-94 Vertical line denotes change. explosives, nuclear components, and special assemblies outside of DOE-controlled sites. m. DOE 5610.10, NUCLEAR EXPLOSIVE AND WEAPON SAFETY PROGRAM, of 10-10-90, which establishes DOE policy, objectives, standards and criteria, authorities and responsibilities for this program. n. DOE 5610.11, NUCLEAR EXPLOSIVE SAFETY, of 10-10-90, which establishes DOE policy, procedures, authorities, and responsibilities for assuring the safe conduct of nuclear explosive activities under the Nuclear Explosive and Weapon Safety Program. o. DOE 5483.1A, OCCUPATIONAL SAFETY AND HEALTH PROGRAM FOR DOE CONTRACTOR EMPLOYEES AT GOVERNMENT-OWNED CONTRACTOR-OPERATED FACILITIES, of 6-22-83, which establishes requirements and procedures to assure that occupational safety and health standards protect DOE contractor employees in Government-owned contractor-operated facilities. p. DOE 5700.6C, QUALITY ASSURANCE, of 8-21-91, which establishes DOE's quality assurance program. q. DOE 6430.1A, GENERAL DESIGN CRITERIA, of 4-6-89, which contains specific safety guidance. r. DOE 4330.4B, MAINTENANCE MANAGEMENT PROGRAM, of 2-18-94, which establishes maintenance management requirements. s. DOE 5480.19, CONDUCT OF OPERATIONS REQUIREMENTS FOR DOE FACILITIES, of 7-9-90, which establishes requirements dealing with the conduct of operation for DOE operators. t. DOE 5480.20, PERSONNEL SELECTION, QUALIFICATION, TRAINING, AND STAFFING REQUIREMENTS AT DOE REACTOR AND NONREACTOR NUCLEAR FACILITIES, of 2-20-91, which establishes the selection, qualification, training and staffing requirements for personnel involved in the operations, maintenance, and technical support of DOE-owned Category A and B reactors and nonreactor facilities. 5. DEFINITIONS. a. Administrative Controls means provisions relating to organization and management, procedures, recordkeeping, assessment, and reporting necessary to ensure safe operation of a facility. a1. Authorization Basis means those aspects of the facility design basis and operational requirements relied upon by DOE to authorize operation. These aspects are considered to be important to the safety of the facility operations. The authorization basis is described in documents such as the facility Safety Analysis Report and other safety analysis; Hazard Classification Documents, and the Technicall Safety Requirements, DOE-issued safety evaluation reports, and facility-specific commitments made in order to comply with DOE Orders or policies. 4 DOE 5480.23 4-10-92 b. Contractor means any person under contract with the Department of Energy with the responsibility to perform activities in connection with a nuclear facility. c. Controlled Document means a document whose content is maintained uniform among the copies by an administrative control system. d. Department or DOE means the Department of Energy.

e. Design Basis means the set of requirements that bound the design of systems, structures, and components within the facility. These design requirements include consideration of safety, plant availability, efficiency, reliability, and maintainability. Some aspects of the design basis are important to safety, although others are not. f. Design Basis Accidents (DBAs) means accidents that are postulated for the purpose of establishing functional requirements for safety significant structures, systems, components, and equipment. g. Engineer Safety Features means systems, components, or structures that prevent and/or mitigate the consequences of all potential accidents including the bounding design basis accidents. h. Hazard means a source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to personnel or damage to a facility or to the environment (without regard for the likelihood or credibility of accident scenarios or consequence mitigation). i. Hazardous Materials means any solid, liquid, or gaseous material that is toxic, explosive, flammable, corrosive, or otherwise physically or biologically threatening to health. Oil is excluded from this definition. j. Item is an all-inclusive term used in place of any of the following: appurtenance, assembly, component, equipment, material, module, part, structure, subassembly, subsystem, system, unit, or support systems. k. NonReactor Nuclear Facility means those activities or operations that involve radioactive and/or fissionable materials in such form and quantity that a nuclear hazard potentially exists to the employees or the general public. Included are activities or operations that: (1) Produce, process, or store radioactive liquid or solid waste, fissionable materials, or tritium; (2) Conduct separations operations; (3) Conduct irradiated materials inspection, fuel fabrication, decontamination, or recovery operations; (4) Conduct fuel enrichment operations; or DOE 5480.23 5 4-10-92 (5) Perform environmental remediation or waste management activities involving radioactive materials. Incidental use and generating of radioactive materials in a facility operation (e.g., check and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and X- ray machines) would not ordinarily require the facility to be included in this definition. Accelerators and reactors and their operations are not included. l. Nuclear Facility means reactor and nonreactor nuclear facilities. m. Program Secretarial Officer (PSO) means the heads of DOE offices with responsibility for specific DOE nuclear facilities. These include the Assistant Secretaries for Nuclear Energy, and Defense Program and the Directors of Energy Research, Civilian Radioactive Waste Management, Environmental Restoration and Waste Management, and New Production Reactors. n. Reactor means, unless it is modified by words such as containment, vessel, or core, the entire reactor facility, including the housing, equipment, and associated areas devoted to the operation and maintenance of one or more reactor cores. Any apparatus that is designed or used to sustain nuclear chain reactions in a controlled manner, including critical and pulsed assemblies, and research, test, and power reactors, is defined as a reactor. All assemblies designed to perform subcritical experiments that could potentially reach criticality are also to be considered reactors. Critical assemblies are special nuclear devices designed and used to sustain nuclear reactions. Critical assemblies may be subject to frequent core and lattice configuration change and may be used frequently as mockup of reactor configurations.

o. Risk means the quantitative or qualitative expression of possible loss that considers both the probability that a hazard will cause harm and the consequences of that event. p. Safety Analysis means a documented process: (1) to provide systematic identification of hazards within a given DOE operation; (2) to describe and analyze the adequacy of measures taken to eliminate, control, or mitigate identified hazards; and (3) to analyze and evaluate potential accidents and their associated risks. 6 DOE 5480.23 4-10-92 q. Safety Analysis Report (SAR) means that report which documents the adequacy of safety analysis for a nuclear facility to ensure that the facility can be constructed, operated, maintained, shut down, and decommissioned safely and in compliance with applicable laws and regulations. r. Safety Basis means the combination of information relating to the control of hazards at a nuclear facility (including design, engineering analyses, and administrative controls) upon which DOE depends for its conclusion that activities at the facility can be conducted safely. s. Technical Safety Requirements (TSRs) means those requirements that define the conditions, safe boundaries, and the management or administrative controls necessary to ensure the safe operation of a nuclear facility and to reduce the potential risk to the public and facility workers from uncontrolled releases of radioactive materials or from radiation exposure due to inadvertent criticality. A TSR consists of operating limits, surveillance requirements, administrative controls, use and application instructions, and the bases thereof. 6. POLICY. It is the policy of the Department that nuclear facilities and operations be analyzed to identify all hazards and potential accidents associated with the facility and the process systems, components, equipment, or structures and to establish design and operational means to mitigate these hazards and potential accidents. The results of these analyses are to be documented in SARs. The identified hazards and the SAR are to be approved by DOE. 7. RESPONSIBILITIES AND AUTHORITIES. a. The Secretary's Responsibilities and Authority. Many provisions in this Order permit and/or necessitate the exercise of discretion and/or judgment in carrying out the requirements of the Order. In those instances, the determination of whether, in the exercise of such discretion and/or judgment, the requirements of this Order were complied with rests initially with the relevant Department authority and, ultimately, with the Secretary. The Secretary retains the sole and final authority to determine what acts are necessary to comply with this Order. Further, the Secretary retains the authority to suspend any and all requirements under this Order whenever the Secretary deems it necessary. This authority may be delegated by the Secretary as appropriate. DOE 5480.23 Chg 1 7 3-10-94 b. Secretarial Officers or their designees in the line organization shall: (1) Require that contractors prepare and update Safety Analysis Reports for each nuclear facility and nuclear operations under their jurisdiction (unless exempted) that establishes and evaluates the adequacy of the safety basis of the facility in accordance with the provisions of this Order.

(2) Review and approve Safety Analysis Reports and revisions thereto for all nuclear facilities and operations. The Secretarial Officer shall issue a Safety Evaluation Report that documents the bases upon which the approvals have been made. The Safety Analysis Report, Safety Evaluation Report, the Technical Safety Requirements Document, and any facility-specific commitments made in order to comply with DOE nuclear safety Orders or policies constitute the nuclear safety facility authorization from DOE for the contractor to operate the facility. (3) Assure that all commitments made in the approved Safety Analysis Report are carried out by the contractors for the nuclear facilities and nuclear operations. (4) Perform the following functions: (a) Issue permanent exemptions to the requirements of this Order for Non Reactor nuclear facilities under his/her cognizance where hazards are of a low magnitude (i.e., hazard Category 3 facilities). These permanent exemptions must be formally issued and must include an adequate basis justifying the action to ensure, that with proper controls, worker and public health and safety are not affected by the consequences of any postulated Design Basis Accidents (DBA). These permanent exemptions may be granted by the responsible Secretarial Officer only after obtaining the concurrences of the Office of Environment, Safety and Health and the Office of Nuclear Energy. (b) Formally request, after obtaining the concurrence of the Office of Environment, Safety and Health and the Office of Nuclear Energy, the Secretary to grant permanent exemptions to the requirements of this Order for hazard Category 1 and hazard Category 2 facilities under his/her cognizance. (c) Grant temporary exemptions to the requirements of this Order for any activity under his/her cognizance, up to one year induration. Prior Vertical line denotes change. 8 DOE 5480.23 4-10-92 to approval, NS-1 and EH-1 shall also be notified in a timely manner in order to discharge their assigned responsibilities. (5) Provide guidance and assistance to field organizations in applying the graded approach for the facility, and the performance of safety reviews, appraisals, etc., to assure contractor compliance with the provisions of this Order. (6) Conduct appraisals to assure contractor compliance with this Order. (7) Transmit the results of the actions taken above to the responsible program managers and field organizations with any necessary or appropriate instructions as to subsequent action to be taken, with a copy to the Office of Nuclear Safety and the Office of Environment, Safety and Health depending on the nature of the issue being addressed. (8) Keep the Office of Nuclear Safety and the Office of Environment, Safety and Health, advised of nuclear safety or nonnuclear, occupational safety and health problems, deficiencies, needs, and actions taken under this Order. (9) Designate an individual(s) to be responsible for bringing to the attention of the contracting officer each procurement falling within the scope of this Order. Unless another individual is designated, the responsibility is that of the procurement request originator (the individual responsible for initiating a requirement on DOE F 4200.33). (a) Procurement request originators (the individuals responsible for initiating a

requirement on DOE F 4200.33) or such other individuals as designated by the cognizant PSO shall bring to the attention of the cognizant contracting officer the following: (1) each procurement requiring the application of this Order, (2) requirements for flowdown of provisions of this Order to any subcontract or subaward, and (3) identification of the paragraphs or other portions of this Directive with which the awardee, or, if different, a sub-awardee, is to comply. (b) Contracting officers, based on advice received from the procurement request originator or other designated individual, shall apply applicable provisions of this Order to awards falling within its scope. For awards, other than management and operating contracts, this shall be by incorporation or reference using explicit language DOE 5480.23 9 4-10-92 in a contractual action, usually bilateral. All paragraphs of this Order shall be applied to contractors excluding Paragraph 7. (10) Designate in writing the design, construction, or operations contractors that will be responsible for preparing a safety analysis report for each nuclear facility or nuclear operation. c. DOE Field Office Managers or Field Program Managers shall: (1) Review and make recommendations to the PSO relative to the adequacy of all new SARs, as well as all revisions to existing SARs. (2) Oversee contractor preparation and review of safety analyses, including nuclear criticality, hazards classification, safety evaluations and changes thereto consistent with this Order and other DOE Orders. (3) Keep appropriate Headquarters program organizations, the Director, Office of Nuclear Safety, and the Field and Area Offices advised of nuclear safety problems, deficiencies, and needs of actions taken under this Order. (4) Designate an individual(s) to be responsible for bringing to the attention of the contracting officer each procurement falling within the scope of this Order. Unless another individual is designated, the responsibility is that of the procurement request originator (the individual responsible for initiating a requirement on DOE F 4200.33). (a) Procurement request originators (the individuals responsible for initiating a requirement on DOE F 4200.33) or such other individuals(s) as designated by the cognizant PSO shall bring to the attention of the cognizant contracting officer the following: (1) each procurement requiring the application of this Order, (2) requirements for flowdown of provisions of this Order to any sub-contract or sub-award, and (3) identification of the paragraphs or other portions of this Directive with which the awardee, or, if different, a sub-awardee, is to comply. (b) Contracting officers, based on advice received from the procurement request originator or other designated individual, shall apply applicable provisions of this Order to awards falling within 10 DOE 5480.23 4-10-92 its scope. For awards, other than management and operating contracts, this shall be by incorporation or reference using explicit language in a contractual action, usually bilateral. All paragraphs of this Order shall be applied to contractors excluding Paragraph 7. d. Director of the Office of Nuclear Safety (NS-1), acting as the independent element responsible for nuclear safety oversight of line management for the Department, shall: (1) Monitor and audit the implementation of all aspects of this Order related to nuclear safety, including field organization and contractor performance;

(2) Review documentation such as Technical Safety Appraisals, implementation schedules, TSRs, SARs and program office and site reports, and observe on- site activities; (3) Identify circumstances that are indicative of deteriorating or poor performance that may warrant further action; (4) Concur with requests for permanent exemptions from the requirements of this Order. e. Director, Naval Nuclear Propulsion Program: Executive Order 12344, statutorily prescribed by P.L. 98-525 (42 U.S.C. 7158, Note) establishes the responsibilities and authority of the Director, Naval Nuclear Propulsion Program (who is also the Deputy Assistant Secretary for Naval Reactors within the Department) for all facilities and activities which comprise the Program, a joint Navy-DOE organization. These executive and legislative actions establish the responsibilities of the Director as including the safety of reactors and associated naval nuclear propulsion plants, the control of radiation and radioactivity associated with naval nuclear propulsion plants, and the operating practices and procedures applicable to naval nuclear propulsion plants. Accordingly, the provisions of this Order do not apply to the Naval Nuclear Propulsion Program. f. Assistant Secretary for the Office of Defense Programs (DP-1): A safety analysis is required for weapons program activities and facilities, but not for individual operations involving the assembly, disassembly, and testing of nuclear explosives, weapons, or devices nor those aspects of these facilities relating specifically to such operations covered by DOE 5610.3. DOE 5480.23 11 4-10-92 g. Assistant Secretary for Environment, Safety and Health (EH-1), acting as the independent element responsible for nonnuclear and occupational safety and health oversight of the line organizations for the Department, shall monitor and audit all aspects of the implementation of this Order related to nonnuclear and occupational safety and health, including line and field organization and contractor performance for these areas. 8. REQUIREMENTS. A contractor, as designated in writing by the PSO, who is responsible for the design, construction, or operation of DOE nuclear facilities shall be required to perform a safety analysis that develops and evaluates the adequacy of the safety basis for each such facility. The safety basis to be analyzed shall include management, design, construction, operation, and engineering characteristics necessary to protect the public, workers, and the environment from the safety and health hazards posed by the nuclear facility or nonfacility nuclear operations. All contractors shall be held responsible for adhering to assumptions and commitments set forth in the safety analysis. Contractors shall be required to prepare, and shall submit to DOE for its approval, SARs documenting safety analyses for each DOE nuclear facility under their cognizance. Contractors responsible for conducting one or more nonfacility nuclear operations are required to maintain up to date analyses of the safety of such operations and analyses documented in a form that is auditable by DOE. Attachment I provides guidance in greater detail than the requirements of this Order. a. Graded Approach for the Level of Analysis. (1) Justification for the level of analyses and documentation for each hazard considered shall be provided as part of the plan and schedule submitted in accordance with paragraph 9(b)(2) of this Order. The level of analysis and documentation for each facility must be commensurate with:

(a) The magnitude of the hazards being addressed; (b) The complexity of the facility and/or systems being relied on to maintain an acceptable level of risk; and (c) The stage or stages of the facility life cycle for which DOE approval is sought. 12 DOE 5480.23 4-10-92 (2) This application of the graded approach is specific for the SAR. b. Scope and Content of Safety Analysis Reports. (1) SARs shall define the safety basis, document the logic of its derivation, demonstrate adherence to the safety basis, and justify its adequacy. (2) Each SAR required by this Order shall include thorough documentation of the assumptions employed in the safety analysis. (3) A SAR shall include the results of the safety analysis that identifies the dominant contributors to the risk of the facility so that these vulnerabilities can be better managed. The safety analysis report shall address the following topics: (a) Executive summary; (b) Applicable statutes, rules, regulations and Departmental Orders; (c) Site characteristics; (d) Facility description and operation, including design of principal structures, components, all systems, engineered safety features, and processes; (e) Hazard analysis and classification of the facility; (f) Principal health and safety criteria; (g) Radioactive and hazardous material waste management; (h) Inadvertent criticality protection; (i) Radiation protection; (j) Hazardous material protection; (k) Analysis of normal, abnormal, and accident conditions, including design basis accidents; assessment of risks; consideration of natural and manmade external events; assessment of contributory and casual events, mechanisms, and phenomena; and evaluation of the need for an DOE 5480.23 13 4-10-92 analysis of beyond-design-basis accidents; however, the SAR is to exclude acts of sabotage and other malevolent acts since these actions are covered under security protection of the facility. (l) Management, organization, and institutional safety provisions; (m) Procedures and training; (n) Human factors; (o) Initial testing, inservice surveillance, and maintenance; (p) Derivation of TSRs; (q) Operational safety; (r) Quality assurance; (s) Emergency preparedness; (t) Provisions for decontamination and decommissioning; and (u) Applicable Facility design codes and standards. c. Hazard Classification for Nuclear Facilities and Operations. Contractors shall be required to perform a hazard analysis of their nuclear activities and classify their processes, operations, or activities in accordance with the following requirements: (1) Classification Categories. The consequences of unmitigated releases of radioactive and/or hazardous material shall be evaluated and classified by the following hazard categories: (a) Category 1 Hazard. The hazard analysis shows the potential for significant offsite consequences. (b) Category 2 Hazard. The hazard analysis shows the potential for significant onsite consequences. (c) Category 3 Hazard. The hazard analysis shows the potential for only significant localized consequences. 14 DOE 5480.23 4-10-92 (2) Inventory of Hazardous Materials. The hazard analysis shall be based on an inventory enveloping all radioactive and nonradioactive hazardous materials that are stored, utilized, or may be formed within a nuclear facility.

(3) Evaluation of Potential Releases. The hazard analysis shall identify energy sources or processes that might contribute to the generation or uncontrolled release of hazardous materials. The hazard analysis shall estimate the consequences of accidents in which the facility or process and/or materials in the inventory are assumed to interact, react, or be released in a manner to produce a threat or challenge to the health and safety of individuals on site and off site. (4) Submission of Hazard Analysis to DOE. The hazard analysis shall be submitted to DOE for approval in accordance with the safety analysis plan and schedule required by paragraph 9(b)(2) of this Order. d. Document Control. Contractors with the primary responsibility for the design, construction, operation, or decommissioning of DOE nuclear facilities must maintain such document control as may be necessary to ensure that all users of SARs and their supporting documentation designated by DOE or the contractor as authorized users, including DOE line management and the Department's safety oversight groups, have current editions. 9. IMPLEMENTATION REQUIREMENTS. a. Approval of Safety Analysis Reports for New DOE Nuclear Facilities. (1) Contractors shall be required to obtain PSO approval of Preliminary Safety Analysis Reports (PSARs) prior to undertaking procurement of materials and components, construction, and preoperational testing of DOE nuclear facilities. DOE may authorize, in writing, limited activities of this type without approval of a PSAR. PSARs shall document the adequacy of the safety basis for a new nuclear facility and provide assurance that the facility can be constructed, operated, maintained, and shut down safely and in compliance with applicable laws and regulations. (2) Contractors shall be required to submit Final Safety Analysis Reports (FSARs) to the PSO for approval and DOE 5480.23 15 4-10-92 authorization to operate DOE nuclear facilities. FSARs shall document the adequacy of the safety basis and provide assurance that the facility can be operated, maintained, and shut down safely and in compliance with applicable laws and regulations. (3) The PSO may direct, in writing, that the PSAR and FSAR for a facility be merged into a single FSAR that meets the requirements of paragraphs 9a(1) and 9a(2) of this paragraph. The PSO may also direct, in writing, that a SAR be submitted in stages. b. Preparation and Submittal of Upgraded Safety Analysis Reports for Existing Nuclear Facilities. (1) Contractors responsible for the operation of DOE-owned nuclear facilities that are scheduled to submit a Safety Analysis Report within 12 months after the date of issuance of this Order, shall implement a program to upgrade, as necessary, the safety analyses to reflect the requirements of this Order. The upgraded safety analysis shall provide assurance that the facility can be operated, maintained, and shut down safely and be in compliance with applicable laws and regulations. Upgraded SAR's shall be submitted to the PSO for approval in accordance with the plan and schedule required by paragraph 9(b)(2) of this Order.

(2) Plan and Schedule for Safety Analysis Reports. Each contractor responsible for submitting a SAR shall be required to submit to the PSO, for its review and approval, an overall plan and schedule for completing this effort. For existing facilities or operations, the plan and schedule shall be submitted to the Department for approval by 6 months after the date of issuance of this Order. This submittal shall describe the need for upgrading the SAR and shall include a preliminary assessment of facility hazards, the basis for the content, schedule, and level of detail proposed, bases for interim operation or restrictions on interim operations, and administrative controls during the upgrade process. Once a submitted plan and schedule is approved by DOE, the contractor shall comply with the plan and schedule, including any DOE modifications. The plan and schedule submitted by a contractor shall be considered approved 180 days after submittal, including any modifications made or directed by DOE during or after this period, unless it is approved by DOE at an earlier date. Approved plans and schedules may be changed, but such changes must be approved in the same manner as initial plans and schedules. 16 DOE 5480.23 4-10-92 c. Periodic Updates of Safety Analysis Reports. Contractors shall be required to review and update as necessary, SARs annually, pursuant to this Order to ensure that the information in each SAR is current and remains applicable. Revisions shall be submitted to the PSO at least annually and shall reflect all changes implemented up to 6 months prior to the filing of the updated SAR. The DOE approval of any Unreviewed Safety Question pursuant to DOE 5480.21, amendments to the TSRs, and the material submitted by the contractor to the PSO in support of these approvals shall be considered an addendum to the SAR until the information is incorporated into the SAR as part of the next annual update. JAMES D. WATKINS ADMIRAL, U. S. (Retired) DOE 5480.23 Attachment 1 4-10-92 Page i (and ii) ATTACHMENT I INTERIM GUIDANCE FOR DOE ORDER 5480.23 SAFETY ANALYSIS REPORT (SAR) DOE 5480.23 Attachment 1 4-10-92 Page iii (and iv) TABLE OF CONTENTS SECTION 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2. Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 3. Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 a. Purposes and Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 b. Major Upgrades in Safety Analysis Requirements . . . . . . . . . . . . . . . . . . . . . . . 6 c. Rationale for Upgrades in Safety Analysis Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 4. Interpretation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 a. Safety Analyses and Safety Analysis Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 b. Safety Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 c. Facility Authorization and DOE's Approval of Safety Analysis Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 d. Commitments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 e. DOE Information Needs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 f. Scope and Content of Safety Analysis Reports . . . . . . . . . . . . . . . . . . . . . . . . . . 16

DOE 5480.23 Attachment 1 4-10-92 Page 1 1. INTRODUCTION a. Paragraph 8 of this Order, requires that DOE contractors responsible for the design, construction, operation, or decommissioning of DOE nuclear facilities and selected DOE nonfacility nuclear operations perform safety analyses. These safety analyses are to develop and evaluate the adequacy of the safety basis for each DOE-owned, contractor-operated nuclear facility or nonfacility operation. b. Contractors must prepare, and submit for DOE approval, SARs documenting these safety analyses. This attachment describes the content, procedures, and analytical approaches for preparation of SARs that are acceptable to DOE for meeting the requirements of this Order. c. This Order specifies the scope and content of SARs, which will define the safety basis, document the logic of its derivation, demonstrate that adherence to the safety basis will ensure that the nuclear safety rules and requirements of the Department are met, and justify the adequacy of the safety basis in protecting the health and safety of the public and workers and the environment. d. The content of an SAR is delineated herein, along with the requirement for documentation of the assumptions employed in the safety analyses. This attachment provides elaboration of each item to be included in an SAR. In providing this guidance, it is recognized that the diversity of DOE facilities may necessitate varying degrees of emphasis to be placed on some of the SAR sections, but the following guidance is intended to be generally applicable. 2. DISCUSSION a. DOE employs safety analyses of its nuclear facilities as the principal safety basis for decisions to authorize the design, construction, or operation of new nuclear facilities. DOE requirements for SARs previously contained in DOE 5481.1B, DOE 5480.5, and DOE 5480.6, are superseded by this Order, except for nonnuclear facilities. (DOE 5481.1B will continue to address requirements for safety analyses of nonnuclear facilities and operations of the Department, which are not within the scope of this Order.) b. The requirements of this Order apply to all safety hazards (nuclear and nonnuclear) of the nuclear facilities and operations, whether nuclear or nonnuclear. Broad application of this Order to all potentially hazardous aspects (nuclear and nonnuclear) of nuclear facilities is to ensure comprehensive, integrated, and balanced Attachment 1 DOE 5480.23 Page 2 4-10-92 risk management of all safety and environmental hazards posed by these facilities and operations. Contractors, in the preparation of SARs, identify how the generic safety requirements of the Department apply to the specific facility, and propose commitments under which the contractor undertakes to design, build, and operate the facility to be in conformance with the applicable statutes, Federal rules, and DOE Directives to ensure facility safety. The Department reviews the SAR and decides whether to authorize the facility (or to approve the SAR, if the facility is already authorized). In authorizing the facility or approving its SAR, the Department may require modified or alternative commitments. In this way, the Department and the contractor responsible for the facility or operation arrive at a common understanding of how the Department's safety rules, Orders, and policies apply in the context of the particular facility. Facility operation is required to be in compliance with the resulting commitments in approved SARs.

d. For existing facilities, this Order calls for upgrading of current safety analyses to meet new requirements. For these facilities contractors must modify existing SARs to reflect current, as-agreed commitments to safety that are binding upon the design, construction, or operation of DOE nuclear facilities. 3. GUIDANCE a. Purposes and Objectives. There are four purposes and objectives for SARs: to (1) provide the bases for approval of new facilities and operations, major modifications thereto, and eventual decommissioning; (2) define and control the safety bases and commitments; (3) support DOE and contractor management safety oversight of facilities and operations; and (4) provide the analytical rationale for operations as delineated in Technical Safety Requirements (TSRs) (see DOE 5480.22). (1) SARs provide the bases for approval of new facilities and operations, major modifications, and eventual decommissioning. To meet this purpose, SARs must: (a) Provide the bases for approval of new facilities and operations, major modifications, and eventual decommissioning. To meet this purpose, SARs must: 1 Identify and assess the hazards posed by nuclear facilities or operations; 2 Demonstrate that the facility or operation can be designed, built, operated, and shut down or decommissioned in conformance with applicable statutes, Federal rules, and DOE Directives; DOE 5480.23 Attachment 1 4-10-92 Page 3 3 Identify the safety design bases and commitments to engineering codes and standards for the facility; 4 Specify the provisions to assure the safety of the facility, including the safety design and operational safety commitments, as well as institutional and human factors safety provisions; 5 Provide analyses of expected releases, exposures, accidents, and consideration of residual risks to furnish the basis for a conclusion that the risks and consequences of operation are acceptable; and 6 Include a critical evaluation of the proposed design, operation, and test program to assess conformance with safety design objectives and verify the projections of the residual risks. (2) SARs serve to define and control the safety basis and commitments for design, procurement, construction, and operation to assure safety at DOE nuclear facilities and selected nuclear operations. This Order defines the "safety basis" as the combination of information relating to control of hazards at a nuclear facility (including design, engineering analyses, and administrative controls) upon which DOE depends for its conclusion that activities at the facility can be conducted safely. The contractor takes the initiative to propose design, construction, operational, and maintenance commitments to assure facility safety. DOE approval action may include modification or addition to these commitments. This approach has the advantage of allowing contractors the freedom to tailor or adapt the DOE generic requirements to the specifics of the facility. The role of safety analyses and the SAR in recording the DOE- contractor consensus on how safety will be assured in ongoing nuclear operations is not just to support the initial safety review and approval for new facilities, but it must also define the basis for continuing operations. A corollary is that SARs must be kept up-to-date as facilities change or are modified. The process of preparing, submitting, reviewing, modifying, or approving SARs establishes the compliance basis for the nuclear safety program for each facility or operation in question. Likewise, the process for updating, upgrading, or amending SARs following DOE authorization is a vehicle by which the responsible contractor may amend and update its commitments to DOE that ensure the safety of the facility or operations.

Attachment 1 DOE 5480.23 Page 4 4-10-92 Over the facility lifetime, the SAR will have continuing functions, as follows: (a) Preliminary Safety Analysis Reports (PSARs) will define the final commitments governing preliminary design, procurement, construction, and preoperational testing of DOE nuclear facilities and will identify preliminary commitments to its ultimate design and operation. (b) Final Safety Analysis Reports (FSARs) are a risk management tool that will define the final basis for safety and risk acceptance for the facility or operation. FSARs will include the operating envelope defined by TSRs, safety design bases, commitments to applicable codes and standards, facility management controls, and institutional and human factors safety provisions. (c) SARs are required to be kept up-to-date to reflect current designs, operations, management, and institutional and human factors safety provisions. (See additional discussion in following sections regarding required updates.) (d) Safety analyses must document the logic by which safety commitments have been derived from or based on generic safety requirements and facility safety objectives to facilitate reassessment of safety commitments in light of new information, proposed changes or modifications to management, and design or operations. (3) SARs for DOE nuclear facilities and operations are also used to support DOE and contractor management and safety oversight of the nuclear facility or operation. DOE program and contractor management need a uniform, up-to-date reference on facility safety with which to plan, budget, and manage nuclear programs. DOE uses SARs for oversight, as follows: (a) DOE program offices depend upon SARs to furnish the safety information with which to plan and budget for safety programs and to assess the safety implications of inservice experience and proposed modifications. Although it is not expected that SARs address budgetary considerations explicitly, those responsible for budget decisions in DOE programs need the tools with which to evaluate the safety implications of budget options and to apportion resources in accord with safety as well as programmatic considerations. SARs are expected to be one of these tools. DOE 5480.23 Attachment 1 4-10-92 Page 5 (b) DOE inspection and oversight personnel depend upon SARs to determine standards and code commitments appropriate to the facility to establish their inspection standards. (c) SARs are a basis to determine the safety significance of violations in determining appropriate enforcement actions by DOE. (d) SARs furnish a consistent assessment of the risk associated with the DOE nuclear operations for use in development of DOE generic safety standards. (e) DOE utilizes SARs to record how safety issues were addressed and resolved in design, construction, and operation to assist in the evaluation of new safety issues as they arise. (4) SARs are prepared in order to be the primary reference on facility safety for the use of the responsible contractor. Among the uses that contractor management makes of SARs are the following: (a) For new nuclear facilities, SARs will be the authoritative documentary record of safety commitments made to DOE governing safety and health aspects of project management, engineering, design, procurement and construction of the facility or the development of the nuclear operation. (b) SARs for new facilities should also document the historical development and use of safety evaluation models employed in design and engineering.

(c) Contractors should also use SARs to support continuing use of these models and evaluations by the contractor in project management, the resolution of nonconformances and operational safety and health issues, the evaluation of proposed changes and new information on the safety of the facility. (d) The SAR and controlled backup documentation should record the development and use of safety and health considerations in the preparation of procurement specifications for materials and components and construction requirements, specifications, and construction inspection standards. (e) For existing facilities, the current safety basis must include those considerations, constraints, and evaluation models needed for continuing engineering, maintenance, and management controls. For existing Attachment 1 DOE 5480.23 Page 6 4-10-92 facilities, those elements of the test program essential to verify conformance with the current safety basis of the facility should be included in SAR updates. (f) FSARs are the documented rationale used to develop the bases for the TSRs, along with commitments to engineering codes and standards. (5) Safety analyses document the safety bases for and commitments to the control of subsequent operations. This includes staffing and qualification of operating crews; the development, testing, validation, and inservice refinement of procedures and personnel training materials; and the safety analysis of the person-machine interface for operations and maintenance. In safety analyses for new facilities and safety-significant modifications to existing facilities, considerations of reliable operations, surveillance, and maintenance and the associated human factors safety analysis should be developed in parallel and integrated with hardware safety design and analysis. Once a nuclear facility or operation is in service, the responsible contractor and DOE safety oversight activities use the SAR, containing commitments to which the Department has agreed, against which to measure compliance. In addition, DOE nuclear facilities need a set of practical safety analysis tools and safety perspective to determine the safety significance and set priorities for corrective action for operational issues or for facility improvements that may be considered. Furthermore, the effective evaluation of operating experience needs a framework to assess the relevance to safety of operating occurrences, to assess new information from outside sources, and to evaluate the importance to safety of identified deficiencies. The SAR should be the basis for all of these considerations. a. Major Upgrades in Safety Analysis Requirements. DOE expects that safety analyses prepared in accordance with this Order will be a significant upgrade from those previously required under DOE 5481.1B, DOE 5480.5, and DOE 5480.6. These upgrades include, but are not limited to, the following: (1) Safety analyses must address institutional and human factors safety in addition to preserving the historical emphasis on safety design and hardware. (2) SARs must clearly define technical commitments to which the operating contractor proposes to be bound in his conduct of the project or operation. (3) SARs are to provide the current facility safety basis to support programmatic decisions. DOE 5480.23 Attachment 1 4-10-92 Page 7 (4) Safety analyses must be kept current and up-to-date.

(5) SARs are to make appropriate use of new safety analysis methods, including, but not limited to, risk assessment, reliability engineering methods, and human factors safety analysis. b. Rationale for Upgrades in Safety Analysis Requirements. The reasons for the upgrades discussed in the previous section are summarized below: (1) Coverage of Institutional and Human Factors Safety Analysis in Safety Analysis Reports. (a) Accidents such as those at Three Mile Island, Chernobyl, NASA's Challenger space shuttle, and the disastrous chemical release at Bhopal, India, have shown that severe accidents occur in complex, hazardous technologies when failures of institutional safety mechanisms and/or weaknesses in human factors safety happen to coincide with design vulnerabilities in one accident scenario. It follows that an effective safety analysis for a nuclear facility should look for weaknesses in each of the three aspects of safety assurance: design, management, and human factors safety. In the past, it has been common practice for safety analyses of nuclear facilities to concentrate on safety design. DOE 5481.1B, DOE 5480.5, and DOE 5480.6 have been generally limited to design safety considerations. (b) In the last decade, however, experience has confirmed that the risk associated from operating nuclear facilities is a combination of (1) the institutional dimensions of the ways safety is assured, (2) human factors safety, and (3) safety design and siting. As used here, the institutional dimensions of safety include management and organization of facility operations; the safety culture sustained by management; quality assurance; the setting of operational performance objectives and the measurement of operational performance; management oversight and assessment and feedback of operational experience, along with management controls of operations, surveillance and maintenance; and related management efforts to achieve and sustain safe operations. Human factors safety, as used here, refers to the allocation of control functions to personnel versus automatic devices; staffing and qualification of operating crews; personnel training; the preparation, validation, and use of written Attachment 1 DOE 5480.23 Page 8 4-10-92 procedures to guide operations, surveillance, and maintenance; and the design of the human-machine interface to build on strengths and protect against the susceptibility to human error in operating crews. (c) The DOE has concluded that its process of reviewing and approving the construction or operation of DOE-owned, contractor-operated nuclear facilities should include a more thorough review and approval of the institutional features of facility management provided to help assure safety and of human factors safety provisions, as well as careful attention to safety design and siting. If SARs are broadened in this way, safety analyses can better fulfill their historical role of documenting the basis for the selection of specific safety features at the subject facility and of forming the basis for confidence in the effectiveness of these safety provisions in their important technical, human, and institutional dimensions. In addition, safety analyses furnish DOE and its operating contractors with a common understanding of the acceptable bounds of facility operation. These bounds can serve as a basis for DOE and contractor management decisions regarding construction, operation, or modifications to nuclear facilities and as a basis for safety oversight, inspection, and performance evaluations.

(d) Finally, the application of safety analysis methods to the selection and justification of institutional and human factors safety commitments can furnish a more objective basis for grading such safety commitments to the specifics of the facility or operation. In this way, DOE and its contractors can be more cost-effective and discriminating: both can be more thorough in identifying and managing the contributor to risk in safety assurance without the undue expense of employing institutional or human factors safety provisions that are not objectively necessary to control the hazards of a particular facility. (2) The Broadened Conception of Commitments in SARs. (a) DOE and its contractors have previously employed a practice of incorporating the safety commitments in the SARs. As part of the upgrade of SARs, DOE will make more explicit use of this method of defining facility-specific safety commitments in order to adapt the Department's generic safety regulations to the very heterogeneous population of DOE nuclear facilities. DOE 5480.23 Attachment 1 4-10-92 Page 9 (b) This Order requires contractors to identify in their SARs specific commitments with respect to the management and organization of facility engineering, construction, and operation programs as well as TSRs and to justify these commitments as appropriate for the facility. In this way, contractors can tailor their safety program to the particulars of the facility. DOE, in its review, will agree to or amend these commitments, so that the acceptable bounds for operation and the basis for facility-specific safety inspection and enforcement standards are known to the operating contractor at the time of approval or facility authorization. Once the new system of safety analysis and DOE review and approval has been implemented, DOE and its operating contractors will have a much clearer mutual understanding of the effect of DOE safety requirements on individual facilities. Furthermore, this Order requires periodic update of the SARs, including updating of the commitments. (3) The Broadened Conception of Safety Analysis Report Use as the Current Safety Basis for Programmatic Decisions. (a) The traditional use of SARs has been to serve as the basis for DOE decisions to approve facility design, construction, and operation. However, it is becoming increasingly clear that additional uses are equally important. Facility management must be knowledgeable in the safety issues surrounding the facility or operation to enable the institutional and human factors aspects of safety assurance to be well- focused, efficient, and effective. It follows that SARs must be practical references for the use of operations management in their day-to-day operations, and that the SAR must be a living document conveying their commitments to safe operations. (b) Contractor management that oversees nuclear facility operations organizations and their support groups also needs a technically sound, practical, comprehensive guide to the safety issues and the bases for safety commitments as a basis for programmatic recommenda-tions to DOE. DOE also needs SARs to be a practical basis for program management, budgeting and planning, safety oversight, inspection, enforcement, and safety standards development. (4) Maintaining Safety Analysis Reports Current. For much of its history, DOE and its predecessors did not routinely require that contractors update safety analyses as Attachment 1 DOE 5480.23 Page 10 4-10-92

facility operations or designs were changed or new information became available. As a result, SARs for some older DOE facilities do not fully reflect the as-built and operated conditions. In addition, the safety analyses of the older DOE nuclear facilities are not as comprehensive, in many cases, as those for newer facilities or for commercial nuclear activities. DOE and many of its operating contractors have recognized the need to upgrade the safety analyses of DOE nuclear facilities, and to keep them up-to-date so that they constitute a current, valid basis for judging the acceptability of the safety provisions at DOE nuclear facilities. DOE has already directed some contractors to develop modern, currently applicable safety analyses for the nuclear facilities that they operate. DOE has now concluded that SARs for all of its nuclear facilities should be kept current as operating practices and designs of its operating nuclear facilities evolve. The SARs should also reflect the lessons of facility operations to refine the evaluation of the safety basis of the facility in SAR updates. (5) Utilization of New Safety Analysis Methods in Safety Analysis Reports. (a) This Order is intended to upgrade the requirements of the analysis to make use of recent advances in state-of-the-art safety analysis. Methods such as risk assessment, severe accident analysis, system reliability analysis, common cause failure analysis, a variety of techniques in human factors safety analysis, and human reliability analysis have demon-strated their worth as supplements to conventional safety analysis methods with commercial nuclear power and in the context of many other hazardous technologies. (b) The Nuclear Regulatory Commission (NRC) is making increasing use of these methods in its regulation of commercial nuclear power. The Environmental Protection Agency (EPA) is requiring a particular form of probabilistic risk assessment as the centerpiece of its requirements for the performance assessment of geological repositories for high-level radioactive wastes, spent reactor fuel, and transuranic wastes in 40 CFR 191. It is considered appropriate for DOE to adopt these improved methods of safety analysis where their use is practical and effective in assessing safety issues and selecting appropriate safety provisions for individual facilities. (c) The methods of human factors safety analysis are expected to be of particular value in tailoring requirements for institutional and human factors safety DOE 5480.23 Attachment 1 4-10-92 Page 11 to the needs of particular facilities. Risk assessment is expected to be of particular value as a management tool in grading safety standards, assessing the importance to safety of facility-specific safety commitments, and evaluating the significance of operating experience, and optimizing the design of modifications and of new facilities. Reliability engineering methods are expected to be particularly valuable in safety design, procurement, and experience feedback, as well as within risk assessment where some reliability analysis methods are extensively used. (d) It is recognized that the implementation of this Order will require a change in the basic approach to safety analyses for nuclear facilities and may require supplements or additions to even the most recently updated SARs. Under this upgraded approach to safety analysis, working definitions of safety culture, operations safety, facility management and organization, and human factors safety must be agreed upon as part of the DOE review of the facility. Subject to DOE approval, contractors will thus have a broader role in defining all the safety criteria to which they will be held accountable by DOE. This is a proper role for contractors who are responsible for the safety of these facilities.

(e) The extensions of safety analysis beyond the historical conception are expected to make safety assessments more effective and reliable in identifying and correcting safety vulnerabilities, while enabling DOE and its contractors to be discriminating and cost-effective in its investments in safety, by doing a better job of understanding safety problems, focusing safety provisions, and judging the importance of safety issues. 4. INTERPRETATION a. Safety Analyses and Safety Analysis Reports (SARs). (1) Page 10, paragraph 8 of this Order refers to both safety analyses and to SARs. The terms are not used inter-changeably. A safety analysis may be performed without preparing or submitting a report. This Order opens with the statement that, "A contractor as designated in writing by the PSO that is responsible for the design, construction, or operation of DOE nuclear facilities shall preform a safety analysis..." Later in the same paragraph this Order indicates that, "Contractors shall prepare, and shall submit to DOE for its approval, SARs documenting safety analyses for each DOE nuclear facility under their cognizance." That is, under the Attachment 1 DOE 5480.23 Page 12 4-10-92 terms of this Order, SARs are required for all DOE nuclear facilities. This Order provides that DOE may exempt selected nonreactor nuclear facilities from the requirement to submit SARs. (2) Page 10, paragraph 8b(3) of this Order provides a listing of specific areas that must be covered in SARs. In the prepar-ation of each SAR, contractors should ensure that each of listed areas are covered comprehensively, as appropriate for each facility. Deviations from this listing requires prior written approval from the responsible DOE Program Secretarial Officer (PSO). Further discussion of each area given in this listing may be found on Page 20, paragraph 4f3(d) of this Order. (3) Safety analyses are required for all DOE nuclear operations; however, the preparation and submission by contractors of a SAR for nonfacility nuclear operations, such as environ-mental remediation programs or the transportation of nuclear materials, will be required only on a case-by-case basis. DOE may require SAR preparation and submittal for non-facility nuclear operations at its discretion, as this Order indicates in paragraph 8 "requirements." Whether or not they are submitted to DOE, contractors responsible for conducting one or more nonfacility nuclear operations of the Department must maintain up-to-date analyses of the safety of such operations documented in a form that is auditable by DOE. b. Safety Basis. (1) Page 11, paragraph 8 of this Order introduces the concept of the "safety basis" of a nuclear facility or operation. The definition given on page 6, paragraph r of this Order is: "Safety Basis means the combination of information relating to the control of hazards at a nuclear facility (including design, engineering analyses, and administrative controls) upon which DOE depends for its conclusion that activities at the facility can be conducted safely." (2) "Safety basis" closely resembles "design basis." However, the safety basis conception is broader than the more traditional "design basis." The term "safety basis" includes the design basis and such safety commitments as conceptual design, safety objectives, formal quantitative definition of safety performance criteria, commitments to engineering codes and standards, equipment qualification requirements, configuration controls, and the bases for and contents of TSRs (ref. DOE 5480.22). In addition to these hardware-related aspects of

DOE 5480.23 Attachment 1 4-10-92 Page 13 "safety basis," the term embraces the managerial, institutional, and human factors dimensions of safety assurance as well. This is the key to the new usage. The use of "safety basis" in place of "design basis" reflects the growing awareness at DOE that the safety of the Department's nuclear facilities requires a balance of institutional and engineering approaches. Management controls, staffing and personnel qualification requirements for operating crews, commitments to maintain written procedures and training for operations and maintenance subject to verification and validation, operational safety requirements, quality assurance, emergency planning, experience feedback, and independent oversight are all part of the "safety basis" for a nuclear facility or operation, though not necessarily a part of the traditional "design basis." It is, in short, the basis for accepting the risk of operation. c. Facility Authorization and DOE's Approval of SARs. (1) This Order makes reference to DOE authorization of facilities and to DOE's approval of SARs. DOE will employ SARs for new facilities and for safety- significant modifications of existing facilities as the principal safety basis for its decision to authorize construction and operation of nuclear facilities. For new facilities, authorization shall generally constitute approval of the FSAR and DOE may document its review with a Safety Evaluation Report (SER). DOE may decide to impose conditions of approval, which might include constraints on TSRs, or alterations to other commitments. The approved FSAR shall be understood to be the FSAR modified as necessary to reflect DOE-imposed conditions of authorization. (2) For existing facilities, SARs must be upgraded to bring them into conformance with this Order. DOE will review, approve and prepare an SER for these upgraded SARs and, again, may impose conditions as part of its approval. (3) While an updated SAR is under review by DOE, the prior authorization or approval may be assumed to remain in effect, as amended by any conditions the Department chooses to impose in writing. DOE will issue a revised SER when an updated SAR involves an unreviewed safety question. d. Commitments. (1) This Order requires that contractors carry out their responsibilities in accordance with the assumptions and commitments set forth in pertinent DOE-approved SARs. In other words, contractors are required to adhere to commitments made in SARs and to conduct operations in such a way that the assumptions made in the SAR are valid. Such assumptions may Attachment 1 DOE 5480.23 Page 14 4-10-92 include, for example, assumptions in accident analyses about the initial conditions of facility operation that might be prevailing prior to an accident, and assumptions made in such institutional safety programs as quality assurance, emergency planning, personnel training and maintenance plans, or surveillance programs. In general, such assumptions about plant conditions and modes of operation should define the outer bounds of the envelope of allowable facility operation. A safety margin should be employed in accident analyses to allow for uncertainties. This margin should be selected to allow for error in measuring how close to the limit of allowed operation the facility or operation is, together with an additional margin for the uncertainties in the accident analysis. Margins should be known, quantified, and documented in the SAR.

(2) All material associated with accident analyses or institution safety programs appearing in an SAR, including such assumptions, are to be taken as commitments to which the operating contractor proposes to adhere. The set of commitments must include facility-specific implementation of nuclear safety requirements. Examples of such commitments include TSRs, the Quality Assurance program plan, and the training program plan. Many commitments will constitute the working definitions of how the particular facility or operation proposes to comply with generic statutes, Federal rules, or DOE Directives. (3) The set of commitments must be sufficiently comprehensive to meet DOE's needs in its role as regulator of the safety of its facilities. The set of commitments must also be sufficiently comprehensive to meet DOE's needs as the responsible owner of its nuclear facilities in regard to safety. Many recent SARs for DOE nuclear facilities limit commitments to Technical Specifications or Operational Safety Requirements TS/OSRs (now called Technical Safety Requirements). These TS/OSRs, in turn, are often limited to those constraints on design or operation found significant to accidents with nonnegligible offsite consequences. Such safety analysis practices may fall short of the requirements in this Order in one of several ways, as follows: (a) Consideration must be given to accidents that pose nonnegligible risks to co-located workers, facility workers, and the environment. (b) Commitments limited to controlling significant accidents may fail to delineate, with clear-cut commitments upon which DOE may rely, how the assumptions of the accident analysis will be sustained. DOE 5480.23 Attachment 1 4-10-92 Page 15 (c) Commitments limited to controlling significant accidents may fail to delineate how the facility will be managed. (4) This information is essential to DOE's safety oversight and program management of its nuclear facilities as well as contractor management carrying on its responsibilities. (5) This Order's language requiring adherence to commitments and assumptions applies only to DOE-approved SARs (paragraph 8 requirements). Adherence is not required, under the terms of this Order, prior to DOE approval. DOE may make compliance with commitments a requirement of facility operation in the interim while DOE review and approval is under way, and will commonly do so for already authorized facilities, but doing so is not mandatory according to the language of this Order. (6) This feature of this Order has been introduced to avoid problems associated with applying the new concept of commitments to SARs prepared prior to the effective date of this Order. There are a number of DOE nuclear facilities with out-of-date SARs. These preexisting SARs will come under the requirement to adhere to commitments only when the preexisting SAR is resubmitted under the terms of this Order that require upgrading and updating SARs. In this way, contractors will have an opportunity to verify whether a preexisting SAR would be problematic or out-of-date and make suitable changes, and DOE must review and approve the resubmitted SAR under the terms of this Order before it becomes subject to the requirement for adherence to commitments. Note, however, that all DOE nuclear facilities must ultimately have an SAR containing commitments subject to this requirement for compliance, unless a specific exemption from this Order is granted by DOE.

e. DOE Information Needs. This Order also requires that SARs serve the needs of the Department for safety information specific to the nuclear facility. This relates to the role of SARs in furnishing not only the information DOE needs to authorize facility design, construction, or operation, but also its continuing needs as owner and safety regulator of its nuclear facilities. The "needs for safety information" to which this Order refers are the needs identified under uses of SARs on Page 2, paragraph 3, of this Attachment. f. Scope and Content of Safety Analysis Reports. (1) "Graded Approach." (Page 11, paragraph 8a of this Order) (a) Paragraph 8a (requirements) of this Order deals with the question of the level of analysis and thoroughness of documentation required for SARs. Attachment 1 DOE 5480.23 Page 16 4-10-92 (b) The essence of the requirement is that the level of effort necessary to create and maintain an SAR, the sophistication of the analyses that go into the preparation of the SAR, and the thoroughness of documentation in the submitted SAR should all be proportioned to three factors: 1 The magnitude of the hazards being addressed; 2 The complexity of the facility and systems being relied on to maintain an acceptable level of risk; and 3 The stage or stages of the facility life cycle for which DOE approval is sought. (c) The first of these captures proportionality with hazard. SAR material dealing with the greater potential consequences, must be more penetrating, thorough, and well-documented than SAR material dealing with lesser hazards. Since consequences and hazard levels are proportional with the conditional risk that would result, given the failure of accident prevention and mitigation, it follows that consideration for this proportionality can be accomplished by developing the SAR material with a thoroughness and rigor proportional to the amount of risk reduction sought through the combination of safety design, operational safety, and institutional safety assurance provisions. For facilities of little hazard, or hazards in category 3 level, for which only a modest reduction of risk is required, the SAR may be simple and short. In such cases all of the topics for the SAR listed in paragraph 8b(3) of this Order will not be necessary and, with proper technical bases, some topics may be omitted or reduced in the detail that would otherwise be required of Hazards Category 1 or 2 facilities. For facilities belonging to Hazard Category 1, for which very substantial limitation of potential risk must be achieved by safety design, management, and well-disciplined operation, the SAR must be particularly thorough and penetrating. Although it is essential that SARs for both reactor and nonreactor facilities be thorough and penetrating, it is not necessarily anticipated that the length and complexity of SARs for nonreactor would be as extensive as the SARs for reactors. (d) In accordance with the second factor, the allocation of emphasis in analysis and documentation should be proportioned to the complexity for each subject in each SAR. DOE 5480.23 Attachment 1 4-10-92 Page 17 For example, subsurface geology of the site is crucial to a geological repository of high-level waste; but as an essentially passive facility, training and qualifications of operating crews is only relevant while the repository is being prepared, the waste emplaced, and the repository sealed.

(e) The final factor to which SARs are to be proportioned is the stage or stages of facility life cycle for which approval is sought. In a PSAR, for example, approval is sought for design, procurement, and construction. Commitments in which these phases of the project are to be conducted and managed are important and deserve prominent attention in PSARs. However, projections of TSRs, procedures and training for the operating phase are preliminary in PSARs. They are present only to demonstrate that safe operation is feasible, that safety issues involving operation have been anticipated, and that appropriate efforts have been made to develop the design with operational constraints and problems in mind. Preliminary commitments, be they commitments for the operational phase in a PSAR or for the decommissioning phase in a FSAR that seeks to achieve or sustain DOE authorization for operation, need not be developed in the detail one would expect if the commitments were to apply to the phase of the facility life cycle that is the proximate subject of the SAR. (2) Page 12, paragraph 8b, of this Order lists a number of features that must be present in each Safety Analysis Report. Each feature is described below. (a) Definition of the safety basis. Safety basis is defined in Section 5 of this Order and should appear in the SAR so that both DOE and the operating contractor can use the SAR for this purpose. Some safety programs also require separate documentation according to the corresponding Orders (e.g., TECHNICAL SAFETY REQUIREMENTS, DOE 5480.22, and QUALITY ASSURANCE, DOE 5700.6C). Therefore, questions often arise on the need to cover such material in two different documents, the SAR and the submittal required by the specialized Order. The material required to be submitted under the terms of the other nuclear safety Orders may be included in the SAR, summarized in the SAR, or incorporated by reference and included in the controlled distribution of the SAR. (b) Documentation of the logic of the derivation of the safety basis. Attachment 1 DOE 5480.23 Page 18 4-10-92 1 The safety basis for each nuclear facility is generally arrived at by considering generic constraints (statutes, Federal rules, and DOE Directives and policies), contractor practices and policies, commercial nuclear industry practices, and applicable nationally recognized codes and standards, together with facility-specific considerations (facility technology, mission, goals, objectives, and DOE requests for the facility). In many cases, specific elements of the safety basis are selected by engineering judgment (e.g., selection of consensus codes and standards in contexts where the choice is not specified by DOE); in other cases, they are arrived at by accident analysis (e.g., parametric limiting conditions of operation) or by other kinds of engineering analysis. Henceforth, formal human factors safety analysis is to receive greater emphasis in identifying the appropriate form and kind of provisions to facilitate reliable performance in safety-related activities by operating crews. 2 It is necessary to document the way the safety basis was arrived at for many reasons. First, assessment of the derivation is one key to DOE's decision to authorize the facility, since the basis for the selection of the safety commitments is an important measure of the adequacy of the safety basis. Second, safety issues often arise due to proposed changes, tests, facility modifications, or new information bearing upon facility safety because of the potential of Unreviewed Safety Questions (USQs) (ref. DOE 5480.21). It is frequently necessary to test the impact of the new information or proposals by reexamining how the logic of the safety basis would be affected by the new information.

(c) Demonstrate that adherence to the safety basis will ensure that the nuclear safety rules and the requirements of the Department are met. SARs are expected to contain analyses and discussions that demonstrate that operation anywhere within the envelope of permitted facility conditions or operations will satisfy the constraints imposed by statutes and directives. DOE 5480.23 Attachment 1 4-10-92 Page 19 (d) Justify the adequacy of the safety basis in protecting the health and safety of the public and workers and the environment. 1 This refers to the analysis of normal releases, incidents, and accidents that may yield adverse consequences for the public or the work force or may contaminate or otherwise have an adverse impact on the environment. The safety analysis should consider a range of conditions, including normal releases, abnormal, accident, and design basis accident, in order to test the adequacy of the protection afforded by commitments to the safety basis. Frequently, it takes the form of testing the facility boundaries to confirm that systems operate within prescribed limits, with adequate margins. A continuous spectrum of such scenarios should be evaluated in order to identify the dominant risk contributor. Where use is made of a representative set of limiting accidents, SARs should document the determin-ation that the set really is representative and that there are no important omissions associated with the use of the set of scenarios taken to be representative. 2 Failure mechanisms that should be considered in exploring the vulnerabilities of DOE nuclear facilities or operations to accidents include equipment failures (active and passive), external disturbances (e.g., earthquakes, storms, floods, vulcanism, transportation accidents, explosions or accidents at neighboring facilities, etc.), human error (errors in operations, maintenance, or surveillance testing), and institutional controls (improper staffing, inadequate availability of essential utilities and functions such as electrical power or emergency response teams, breakdown of quality control, problems with qualification of spare parts, etc.). (3) Page 12, paragraph 8b(2), of this Order reads: "Each Safety Analysis Report required by this Order shall include thorough documentation of the assumptions employed in the safety analysis." (a) Note that this language applies only to SARs required by this Order. The clause requiring "thorough documentation of assumptions" has been introduced into this Order in response to instances in which reviewers have been frustrated by an inability to determine the Attachment 1 DOE 5480.23 Page 20 4-10-92 assumptions employed in accident analyses and other parts of SARs for DOE nuclear facilities. (b) This requirement is not meant to require unnecessarily detailed documentation of every supporting calcula-tion. In some cases, it may be appropriate and permissible to reference supporting calculations that are not reproduced in SARs. However, such supporting calculations and reports must be maintained so as to be readily retrievable. The SARs prepared under this Order may summarize such detailed calculations and supportive reports, but should clearly report their limitations and major assumptions, so that reviewers are not mislead concerning the limitations of scope, coverage, or assumptions of material in the SAR proper or in supporting material.

(c) A part of the documentation of assumptions must be a systematic search for unquestioned premises. This follows from the observation that some of the most severe nuclear accidents, such as those at Three Mile Island and Chernobyl, and many of the more serious deficiencies in the DOE nuclear facilities, can be traced, at least in part, to presumptuous thinking in the safety analysis or human error. (d) Safety Analysis Report (Page 12, paragraph 8b(3) of this Order). This paragraph furnishes a checklist for the contents of SARs. Of primary importance to DOE is that SARs meet the objectives, purposes, and roles for SARs identified above. This Order requires that each of the listed areas, Page 12, paragraph 8b(3) as a minimum, are to be addressed in an SAR. However, depending on the extent and potential hazard of a given facility, some reduction in coverage under each area or combination of subjects may be proposed by the contractor for approval by the responsible PSO. The following headings appear in this checklist within this Order, followed by guidance on the intended content. 1 Executive Summary. SARs should open with the following general and introductory information: a An executive summary should be included to give readers a brief overview of the facility, the more detailed safety analysis to follow, and the purposes for which the safety analysis was prepared. The summary of the safety analyses should describe the potential hazards that have been addressed, the design basis accident (DBA) and risk-dominant accident scenarios that have DOE 5480.23 Attachment 1 4-10-92 Page 21 been analyzed, and the measures taken to eliminate, control, or mitigate the consequences of these accidents. Only the findings and results of the safety analyses should be summarized, leaving the details of the analysis to be described in the appropriate sections of the SAR. b The prime contractors for design, construction, and operation should be identified, along with the architect-engineer for the facility. Safety-significant consultants, oversight groups, and outside service organizations should also be identified. The summary should clearly define the facility, including its physical and institutional boundaries, distinguishing it from other DOE facilities or operations outside the scope of the analysis and clearly defining those external functions, such as utilities or external support organizations (e.g., fire brigades on which the safety of the facility depends). c The summary should identify the stage or stages of the facility life cycle for which the SAR has been prepared and for which DOE authorization is sought. To support advanced planning of phases of the facility for which details have yet to be defined or DOE authorization sought, it should also identify the phase or phases of facility life cycle for which preliminary or conceptual information is given. d The summary should include a guide for the reader to the structure and content of the main Safety Analysis Report, its chapters, and appendixes. 2 Applicable Statutes, Rules, and Departmental Orders. SARs should identify the applicable statutes, rules, and DOE Orders binding upon the safety basis and operation of the facility. State and local statutes, ordinances, and other requirements should also be included when they establish safety constraints on facility operation. Sufficient detail should be provided for the SAR to serve as a comprehensive reference on applicable statutes, Federal rules, and DOE Orders for use in engineering, operations management, program management, and safety oversight. Specific sections or references should be included in the SAR that

Attachment 1 DOE 5480.23 Page 22 4-10-92 explicitly demonstrate compliance with these applicable statutes, rules, and Orders. 3 Site Characteristics. a SARs should identify whether the facility site has already been selected by DOE, or a subject for DOE review and approval supported by the current safety analysis, or whether an envelope of potentially acceptable site characteristics is being addressed in the safety analysis. b In the event that a particular site has been selected or is under consideration, the safety analysis should include a detailed description of the site. The precise location of the site should be described such that there is no ambiguity concerning its relation to other manmade or natural features of the local terrain. The description of the site and its boundaries, and areas beyond the boundaries that could be affected by the release of radioactive or other hazardous materials from the site, should include: i. The State and county in which it is located; ii. The location of the site relative to prominent natural or manmade features such as rivers, lakes, and population centers; iii. Detailed maps of the site of suitable scales to define clearly the site boundary and the distances from significant site structures to the site boundary and to locate the site with respect to regional terrain features, nearby residences, and population centers; iv. Local and regional transportation routes (roads, railroad tracks, and airports), electrical transmission lines, natural gas pipelines, oil or natural gas storage depots, local industrial facilities, etc.; and v. Definitions of the facility exclusion area and the site boundary with respect to public exclusion areas, access control areas, property lines, and distances from DOE 5480.23 Attachment 1 4-10-92 Page 23 the site boundary to potential effluent release points. c Safety Analysis Reports should contain sufficient information to enable qualified accident analysts to identify and quantify environmental threats that may contribute significantly to the risks posed by the facility by giving rise to accidents or releases from the facility. This includes natural events, such as earthquakes, floods, or storms, and external accidents involving manmade processes or facilities such as transportation accidents, or accidents at other DOE or non-DOE facilities in the vicinity of the site. The site should be characterized as necessary to support the requirement for facility hazard classification on page 23, subparagraph (5), for accident analyses on page 26, subparagraph (k), and to support the selection of principal safety criteria on page 23, subparagraph (6) of this attachment. The site should be specified adequately to determine the input parameters required for models of the dispersion of released radionuclides and other hazardous materials for accident analyses required on page 26, subparagraph (k) of this Attachment. d Site characteristics to be described should include demography, local and regional meteorology, climatology, regional land and water use patterns, surface and subsurface hydrology, geology, seismology, and any unique or special features of the site relevant to the safety analysis.

e Site parameters should include, but not be limited to, population sheltering or shielding parameters, evacuation delay times and rates for the public and of co-located workers, and the characteristics of other DOE facilities and other property that may be at risk from accidents at the subject facility for analyses required by subparagraph (k) below. In addition, safety analyses should contain sufficient information to confirm that site-related assumptions made in prior environmental analyses or impact statements have been validated, or that they have fully identified the need to revise and update environmental statements for the facility. Attachment 1 DOE 5480.23 Page 24 4-10-92 4 Facility Description and Operation, Including Design of Principal Structures, Components, Systems, Engineered Safety Features, and Processes. a Safety analyses should contain descriptions of the facility and the principal equipment and processes provided to fulfill the mission of the facility and should delineate the plans, provisions, and requirements for their operation, maintenance, and surveillance. Information on the design of principal structures, components, and systems should be furnished in sufficient detail to support the identification of hazards, principal safety criteria, selection of engineered safety features, and the analysis of accidents. This information should include the following, using drawings as necessary: i. A listing of the safety-significant structures, systems, components, equipment, and processes discussed in this section of the report; ii. Detailed descriptions of structures or containers used to confine radioactive materials or hazardous chemicals; iii. Detailed descriptions of safety-significant mechanical, electrical, and fluid systems (i.e. decay heat removal methods for reactors and applicable non-reactor nuclear facilities), including functions, design bases, and relevant design features; iv. Detailed descriptions of chemical process systems, including infor-mation on design configuration, dimensions, materials of construc-tion, pressure and temperature limits, corrosion allowances, and any other operating limits, and; v. A functional description of process and operational support systems, including instrumentation and control systems. b The SAR should furnish system descriptions, including current general system drawings and process information drawings showing sufficient detail to enable qualified reviewers to verify conformance with safety design bases, codes, standards, and commitments. Systems descriptions DOE 5480.23 Attachment 1 4-10-92 Page 25 in the SAR should also include auxiliaries, utilities, instrumentation, and control systems necessary for engineered safety features to perform their functions and their associated uncertainties under accident conditions. These descriptions should be in sufficient detail to enable qualified reviewers to verify conformance with safety design bases, codes and standards, and commitments. For each engineered safety feature (ESF): i. Describe the function of the ESF as it relates to safety; ii. Describe any interfaces with other safety systems (e.g., emergency power systems) and any dependencies upon auxiliary or ancillary systems; iii. Describe the specific set of conditions under which the ESF must function in its safety role. These conditions include temperature, pressure, humidity, concentrations of airborne materials, and any other physical conditions that could challenge the ability of the ESF to perform its function;

iv. Based on these conditions, state the performance criteria for the ESF and list the DBAs and other accident scenarios that were used to determine the accident conditions and the performance criteria. c The engineering safety features should also be described in sufficient detail to permit facility engineering, procurement, operations, and maintenance personnel to identify all safety design and configuration commitments to which they must adhere, or to identify the consequent changes that must be made if an altered safety commitment is contemplated. Adequate information must be provided to serve as the basis for accident analysis to characterize safety system design and performance and to furnish the systems information by which failure modes may be identified as necessary to support accident analysis. The SAR should also furnish information on the plans and provisions for the operation, maintenance, and surveillance of engineered safety features. Attachment 1 DOE 5480.23 Page 26 4-10-92 5 Hazard Analysis and Classification of the Facility. This section should identify the inventory of hazardous materials (type and amount), including radioactive materials and chemical materials that could lead to a reportable event. In establishing this inventory, it should be ensured that inventories to be encountered in facility operations are adequately enveloped. The energy sources and release processes shall be specified to assess the hazards of the facility, and the bounding analyses of potential accidents associated with each type of hazard should be documented. Finally, the SAR should include a hazard level classification for each major type of hazard at the facility, as well as an overall facility hazard classification in keeping with the requirements of paragraph 8c of this Order, "Hazard Classification for DOE Nuclear Facilities and Operations." 6 Principal Health and Safety Criteria. a This section discusses safety criteria for structures, systems, components, equipment, and processes, generally through references to published codes and standards such as those of the American National Standards Institute (ANSI), the Institute of Electrical and Electronics Engineers (IEEE), the American Society of Mechanical Engineers (ASME), and other professional and standards organizations. b Facility equipment and engineered systems to be discussed as applicable are those that support the safety functions of the facility, such as confinement barriers and systems, effluent treatment systems, ventilation and offgas systems, equipment and instrumentation designed to perform specific safety functions, monitoring and alarm systems, and radiation shielding. c Process equipment and engineered systems to be discussed as applicable are those that are safety significant and specific to individual processes, such as nuclear criticality prevention systems, waste handling and treatment systems, and industrial or chemical safety systems. d For new DOE facilities, the discussion of principal safety criteria in SARs should include the national consensus codes and standards to be followed and other requirements used to measure DOE 5480.23 Attachment 1 4-10-92 Page 27

the adequacy of safety (e.g., NRC requirements adopted for use). The discussion should also describe the bases for decisions to allocate safety functions to passive devices or inherent mechanisms, to active devices, or to operations personnel, as well as criteria against which the specifics of such allocation may be judged. For existing DOE facilities, the discussion of principal safety criteria in SARs should include the bases for determining whether the existing allocation of safety functions to passive devices or inherent mechanisms, to active devices, or to operations personnel is consistent with the satisfactory assurance of safety or whether it requires focused analysis to determine the possible need for alternative or compensatory measures. Safety analyses should describe the conceptual design of safety functions and safety features in sufficient detail to support the selection of facility-specific principal safety criteria that are tailored to the facility and the conceptual design of its safety equipment. e Safety analyses should also describe the logic by which principal safety criteria have been derived or adopted from generic safety and related environmental constraints contained in statutes, rules, and Departmental Orders, together with DOE and contractor safety policy and goals. In addition, considerations of the particular facility and its technology, conceptual design, and site should be included. This logical basis should be sufficiently documented to enable qualified readers to determine the appropriateness of the principal safety criteria and to determine whether a change in principal safety criteria is warranted in light of new generic requirements, new information about the facility, or changes in facility design or operation. 7 Radioactive and Hazardous Material Waste Management. a The SAR should include estimates of the quantity and form of radioactive wastes generated incidental to the mission of each DOE nuclear facility, as well as equipment, provisions, and plans for the management of these wastes. This information should be presented in sufficient detail to support the determination of adequate protection of the public, workers, and the Attachment 1 DOE 5480.23 Page 28 4-10-92 environment and to support the data needs of other SAR sections. Note that if the management of radioactive wastes is among the missions of the facility, such waste management should be addressed under subparagraph (d) (Facility description and operation, etc.). b Discussions of solid, liquid, gaseous radwaste forms, and, if applicable, Waste Minimization Programs are to be included in the SAR, along with discussions of mixed radwaste/toxic chemical waste, as appropriate. For each waste form, the following information should be presented: i. Waste management process. Discuss the overall philosophy, objectives, and the general process for handling the different forms of radwaste or mixed waste. Discuss the administrative and operational controls important to the effective management of the different waste forms. ii. Waste sources and characteristics. Discuss how and where the waste is generated and how it enters the appropriate waste handling system. Describe the quantities, chemical forms and characteristics, physical characteristics, and radiological or toxic/radiological composition, as appropriate. iii. Waste treatment systems. Discuss the methods employed

to control or mitigate the potential impacts of the different waste forms. Describe the operating principles, functions, and performance objectives of waste handling equipment and systems. Include engineering drawings to indicate flowpaths and to show the locations of equipment and instrumentation. 8 Inadvertent Criticality Protection. Safety analyses should contain information to demonstrate compliance with applicable requirements for the prevention of inadvertent criticality. This discussion should include the following topics: a The criteria used to ensure subcritical situations in operations and storage under the worst credible conditions; DOE 5480.23 Attachment 1 4-10-92 Page 29 b The parameters used for the prevention and control of criticality for activities involving fissionable material and the application as discussed in American National Standard ANSI/ANS 8.1 (1983) of the "Double Contingency Principle for criticality safety" as discussed above. c The application of the Double Contingency Principle for criticality safety as discussed above; d The criticality safety design limits, their bases, and any design criteria used to ensure that criticality safety limits are not exceeded; e The error contingency criteria selected for the facility; and f The criteria for establishing verification. 9 Radiation Protection. Safety analyses should contain sufficient information to demonstrate compliance with the radiation protection requirements of DOE 5480.11. As a minimum, the following topics should be addressed in the discussion: a The as-low-as-reasonably-achievable (ALARA) policy and program; b External radiation exposure control; c External dosimetry; d Internal radiation exposure control; e Internal dosimetry; f Radiological protection instrumentation programs (both calibration and use); g Respiratory protection program; h Air monitoring; i Radiological monitoring and contamination control; j Radiological protection recordkeeping; Attachment 1 DOE 5480.23 Page 30 4-10-92 k Radiological area boundaries, posting, and controls; l Radiological protection training; and m Entry and exit control program. 10 Hazardous Material Protection. Safety analyses should contain sufficient information to demonstrate compliance with applicable requirements for control of personnel exposures to hazardous materials. The hazardous materials are those in quantities that can adversely impact the health and safety of the public or pose a reasonable risk to workers. This discussion should include the following topics: a The policy or program for keeping exposures to hazardous chemicals or other materials as low as reasonably achievable (ALARA); b Bioassay or medical monitoring programs; c Air monitoring; d Workplace monitoring; e Recordkeeping on hazardous material exposures; f Instrumentation (maintenance and calibration for safety setpoints and alarms); g Instrument calibration; h Hazard communication programs; and i Hazard evaluation and elimination programs. 11 Analysis of Normal, Abnormal, and Accident Conditions, Including Design Basis Accidents. a Safety analyses should include the application of methods such as deterministic safety analysis, risk assessment, reliability engineering, common-cause failure analysis, human reliability analysis, and human factors safety analysis techniques as appropriate to the identification, investigation, elimination, mitigation, or control of vulnerabilities of the facility to accidents and accidental releases. Accident analyses for the facility should identify and classify the spectrum of accident sequences or scenarios that release hazardous materials,

DOE 5480.23 Attachment 1 4-10-92 Page 31 ranging from normal events through those identified as low probability - high consequences. b The range of accident scenarios analyzed in an SAR should be such that a complete set of bounding conditions to define the envelope of accident conditions to which the operation could be subjected are evaluated and documented. The spectrum of likelihood for accidents range from those expected to be frequently experienced to those that are possible, but unlikely, during the lifetime of the project. The likelihood and consequences of the classes of accidents that are utilized to provide the design parameters for release barriers and mitigating systems should be identified (design basis accidents). c The likelihood and consequences of accidents beyond the design basis accidents should be evaluated to provide a complete documented rationale for acceptance or rejection of the operation of the facility, and to estimate the residual risk associated with facility accidents. The safety analysis is to consider beyond- DBAs as to the potential effects to the public health and safety and protection for the workers. An evaluation is to include an assessment of risk reduction protecting against beyond-DBAs, as opposed to protecting at the level of the DBAs as a method for evaluating the adequacy of the DBAs. An assessment of the potential gains in the level of safety should be performed in the context of the backfit policy. d The hazards of a project determine potential initiating events that lead to various accidents. When developing accident scenarios, these initiating events are assumed to occur. Based on the materials and energy involved, the physical parameters of the immediate environment can be determined. These parameters may include energy density, temperature, humidity, smoke, concentration of toxic and/or corrosive fumes, shrapnel, explosive atmosphere, and so on. From knowledge about the targets of the hazards, the barriers between the hazard and the targets can be identified. Barriers may take the form of safety- related systems or administrative controls. In most instances, administrative controls either remove targets beyond range of Attachment 1 DOE 5480.23 Page 32 4-10-92 the hazard or are aimed at greatly reducing, if not eliminating, the likelihood of an initiating event caused by personnel error or equipment failure. For accident scenarios, the analyst should concentrate on evaluating the sequence of events that lead to an adverse consequence. e The challenges to the barriers are those physical conditions defined by the accident. It should be determined whether or not the barriers will fail when challenged by the conditions resulting from the accident, for example, the dropping of a toxic material container from a work surface to the floor. Does the barrier to the release of material (the container) rupture or stay intact? In the case of the detonation of high explosives, do blast walls and doors resist the explosion? f If the accident challenges the barriers at the level of their design limits, it is suggested that the analyst conservatively assume the barrier will fail. If, on the other hand, the challenges (including any known uncertainties in estimation) are clearly below the design limits, assume that the barrier will function. When the analyst has sufficient data available on failure rates, probabilistic risk analysis is possible and should be considered for part of the accident analysis. A Fault Tree analysis can be used to estimate the probability that a barrier will fail under the specified conditions (challenges).

g Accident scenarios in which an accident situation occurs and barriers placed to protect targets are challenged have been considered and are only one type of accident that can occur. Another class of accident scenarios should also be considered. This is the class in which barriers are required for normal operations and a barrier failure is the initiating event. The accident scenario is developed by assuming the failure of the initial barrier and then calculating the conditions that result. The scenario is developed as before, with the analyst looking at the expected behavior of subsequent barriers. When available, likelihood information can be applied to initial barrier failure during normal operating conditions. Another closely related set of scenarios is that in which the initial barrier failure is the result of changing the operating conditions, so that the limits of the barriers are exceeded. DOE 5480.23 Attachment 1 4-10-92 Page 33 These could be referred to as operating-error-induced accidents. When appropriate, these accidents should also be analyzed. h Because of the complex nature of typical DOE sites, in addition to the previously discussed accident scenarios, scenarios that are initiated due to accidents at neighboring facilities (i.e., explosions, toxic chemical releases, etc.) should also be analyzed. i The accident analyses should demonstrate: i. The adequate protection of health and safety for members of the public both on and off the DOE reservation at which the facility is located; ii. The health and safety of workers on the DOE reservation not involved in or responsible for the facility or its safety; iii. The adequate protection of the environment from accidental contamination by the facility; and iv. The adequate protection of facility workers, particularly as necessary to support their reliable function of safety- related activities as well as individual protection. j Accident analyses should be developed to furnish an objective basis for verifying the adequacy of provisions to both prevent and mitigate accidents. Accident analyses should also provide the basis for evaluating the incentives and priorities for alternatives that may reduce facility risks. This includes the bases for prioritizing upgrades and cost/benefit evaluations of tradeoffs between alternatives in the safety design, operations, and maintenance, considering the differences in the effectiveness and the attendant risks of alternative safety provisions. k Accident and incident analyses should be developed as necessary to identify and validate the technical content of skills and abilities catalogs needed for the development of training Attachment 1 DOE 5480.23 Page 34 4-10-92 and operating procedures for normal, abnormal, and emergency conditions. Documentation should summarize such accident analysis, identify the criteria employed to judge technical accuracy and sufficiency of such accident analyses, and identify those technical content requirements for procedures and skills and abilities found to be most important in limiting facility risk. l Accident analyses should include the derivation and documentation of measures of importance-to-risk or importance- to-safety as applied to a hierarchy of safety provisions (defense in depth). The hierarchy should identify the importance of safety functions. These measures of importance should be employed to focus safety efforts and calibrate the level of effort in safety.

m Failure modes of equipment or personnel found to be particularly "important to safety" must be examined to determine whether the safety of the facility is unduly dependent upon such components or personnel actions. The allocation of safety functions may require modification to reduce the importance-to-safety of critical links in the assurance of safety. This is particularly important for hazards warranting Hazard Category 1 ranking. Consideration must be given to employing additional levels of assurance, diversity, or redundancy to avoid placing undue reliance on any one safety device or personnel action. n Accident analyses should document the derivation of environmental qualification requirements for safety components. This includes establishing the environmental conditions (e.g., radiation levels, humidity, pressure, temperature) that could be created in rooms containing safety components by credible accidents during which those components would be called upon to function. The analyses should justify the capability of components to withstand these conditions and accomplish their intended function. o Accident analyses should also demonstrate the effectiveness and appropriateness of the principal safety design criteria for the facility, as well as a basis for determining DOE 5480.23 Attachment 1 4-10-92 Page 35 whether new information or proposed changes warrant changes in principal safety design criteria. Compliance with those safety design criteria should be demonstrated in terms of accident characteristics, including consequence limits, likelihood limits, or risk limits. p Accident analyses should furnish a basis to derive the TSRs for the facility. Accident analyses also should furnish a framework or set of evaluation models with which to determine whether new information or proposed changes in facility design or operation constitute Unreviewed Safety Questions, and to provide a basis for reviewing and evaluating such information. Finally, accident analyses should serve as a basis for deriving safety performance criteria and serve as a basis for evaluating the safety significance of operational events for use in experience feedback. 12 Management, Organization, and the Institutional Safety Provisions. a Safety analyses should identify the structure of those contractor organizations responsible for the design, construction, or operation of the DOE-owned nuclear facility and discuss the ways the organization deals with facility safety issues. Specifically, safety analyses should identify the mechanism for coordination and communication with respect to safety issue discovery, management, coordination, and resolution among the groups dedicated to facility design, construction, or operation. Such identification should include organizational responsibilities and interfaces between those subgroups responsible for different aspects of safety including, for example, engineering, procurement, construction, startup, operations, maintenance, quality assurance, compliance determination, personnel training, and development of procedures. b Furthermore, safety analyses should address interfaces between any groups dedicated to the facility and those contractor groups with affiliations external to the facility but involved in facility safety assurance such as: engineering (if external), groups responsible for utilities upon which facility safety features Attachment 1 DOE 5480.23 Page 36 4-10-92

depend, emergency response organizations, groups specializing in safety analysis services, and so on. This discussion should address communication, coordination, and other subjects bearing on known and potential facility safety issues. This information should be presented in sufficient detail to enable qualified reviewers to determine the effectiveness and reliability with which facility safety problems can be communicated, coordinated, and effectively resolved in the contractor support organizations. c Safety analyses should also discuss those contractor initiatives undertaken to effect a safety culture, team-building, and safety consciousness and should encourage a questioning attitude among those with a direct or indirect effect on facility safety. In this regard, this section should identify the mechanisms to which the contractor proposes to commit for the contractor-sponsored independent review and appraisal of the safety performance of the facility and its contractor team. The safety-significant administrative controls and procedures should be summarized in sufficient detail to enable qualified reviewers to evaluate the strengths and weaknesses of the administrative checks and balances in place in design, construction, or operations organizations. d The SAR should identify the mechanisms for the control of modifications to the design, construction, or operation of the facility; for the selection of operating plans; and for the selection of short-term and long-range surveillance and maintenance. This should include the configuration control and document control programs for the facility. e Provisions should be identified for the selection and analysis of information for Occurrence Reports (ref. DOE 5000.3A), for the evaluation of operational experience, and for the development of feedback or corrective action. f With regard to staffing and qualifications, this SAR section should: i. Identify the bases for minimum shift manning and the identification of job DOE 5480.23 Attachment 1 4-10-92 Page 37 knowledge, skills and abilities. This documentation should summarize the development of job analyses, that, together with accident analyses, support these determinations. ii. Provide the basis for allocating operational, emergency response, and monitoring functions to onshift, onsite positions; and on-call or intermittent positions. iii. Document the bases for the staffing levels and job candidate qualifications requirements for safety-related operational positions and fitness-for-duty requirements imposed on facility operations staff. iv. Identify programs or provisions to monitor the human performance of operational personnel or enhance it through team-building, feedback mechanisms, etc., supplemental to normal line management and training provisions. 13 Procedures and Training. a This section of the SAR should document the processes by which the technical content of procedures are developed, verified, and validated. Such commitments to the development of the technical content of procedures should cover procedures for the conduct of normal, abnormal, and emergency operations; for surveillance testing; and for maintenance. The same or comparable commitments should be made to the way the technical content of personnel training programs is developed. The SAR should summarize and make appropriate reference to details for the use of accident analyses, other safety analyses, and measures of importance to safety in support of the selection and validation of procedures and training materials. These commitments should be documented in sufficient detail to enable qualified reviewers to verify that the program is adequate to produce and maintain technically appropriate procedures.

b The processes by which the form and content of written procedures and training elements are developed, verified, and validated should be Attachment 1 DOE 5480.23 Page 38 4-10-92 documented in this section. This may be done by the use of a standard format for procedures that has been selected to minimize confusion and lend itself to reliable use, editorial review by experts in human factors and by those who will be called upon to use the procedure, along with trial applications of the procedures to determine their effectiveness in simulated applications, as appropriate to the importance of the procedure to safety. c This section of the SAR should also document the mechanisms to identify and correct technical or human factors deficiencies in written procedures through experience accumulated in training programs, personnel examinations, and facility operating experience. The SAR should describe provisions to assure adequate overall configuration control for procedures, and to assure that necessary training and coordination is done before the introduction of new procedures or the introduction of changes in the human-machine interface covered by procedures. d Sufficient information should be provided to demonstrate commitment to training programs that comply with the requirements of DOE 5480.20, PERSONNEL SELECTION, QUALIFICATION, TRAINING, AND STAFFING AT DOE REACTOR AND NON-REACTOR NUCLEAR FACILITIES. Information should include descriptions of the initial and continuing training programs for normal and abnormal operations and emergency conditions and the organizational responsibility for conduct of training and the maintenance of training records. Aspects of the training program that should be described include (1) methods used to derive program content, (2) methods used to accomplish training, (3) qualification requirements for instructors, (4) qualification requirements for operators, maintenance, and technical support personnel, (5) certification requirements for positions required to be certified, (6) methods used to analyze and factor operating experience into training programs, and (7) methods used to evaluate the effectiveness of the training program and to improve its effectiveness on the basis of feedback. DOE 5480.23 Attachment 1 4-10-92 Page 39 14 Human Factors. The SAR should include a systematic inquiry into the importance to safety of reliable, correct, and effective human-machine interactions, including the activities of surveillance, maintenance, and normal, abnormal, and emergency operations. In those contexts in which reliable, effective human performance by the operating crew is important to safety, and in proportion to that importance-to-safety, safety analyses should document a systematic inquiry into the optimization of the design of the human-machine interface to enhance reliable human performance. These design considerations should include: a The determination that the furnished instrumentation, provisions for communication, and operational aids are sufficient to support the timely, reliable performance of human operations important to safety; b Consideration of the layout and design of controls and instrumentation, and the provision of labeling, to verify its consistency with the reliable performance of those human activities of particular importance to the safety of the facility;

c Description of work environment factors that might degrade the reliability of operations personnel in tasks, including surveillance and maintenance as well as operations, of particular importance to facility safety. Work environment factors to be considered include physical access, the need for protective clothing or breathing apparatus, noise levels, temperature, humidity, distractions, and other factors bearing upon physical comfort, alertness, fitness, etc.; and d Document a systematic inquiry into the ability of facility staff to accomplish their responsibilities in potential accident environments. 15 Initial Testing, Inservice Surveillance, and Maintenance. a Safety analyses should delineate the plans and provisions for initial and inservice testing, Attachment 1 DOE 5480.23 Page 40 4-10-92 documenting the assessment of the adequacy of the provisions for tests, the scope of tests, and the frequency and timing of tests, in the context of the provisions and capabilities for maintenance and repair. Safety analyses should document a systematic demonstration of the ways the surveillance test program furnishes realistic validations of the performance of safety functions under accident conditions, and catalogs failure modes of safety equipment that could be detected in planned surveillance tests. Safety analyses should document a systematic inquiry into whether limitations of the surveillance test program are acceptable or warrant changes in test plans or provisions, or compensatory action, such as environmental qualification requirements, special analyses, etc. This inquiry should explore the safety implications of the possibility that faults and failure modes may, undetected, occur or accumulate over the service life of the facility. For new facilities and significant modifications to existing facilities, safety analyses should be extended to cover acceptance, startup, and initial tests as well as in-service tests. b With regard to maintenance, sufficient information should be provided to demonstrate a commitment to comply with the requirements of DOE Order 4330.4A, MAINTENANCE MANAGEMENT PROGRAM. This information should include: i. A general description of the maintenance philosophy, objectives, and organization; ii. The assignment of responsibilities for specific maintenance functions within the maintenance organization; iii. The structures, systems, components, and equipment included in the formal maintenance program; iv. The management systems used to control maintenance activities; and v. A description of the interfaces between maintenance and the other facility organizations (e.g., operations, engineering, and quality assurance). DOE 5480.23 Attachment 1 4-10-92 Page 41 c Safety analyses should document the limitations imposed by design and operation upon routine maintenance, renewal, and repair of structures, systems, and components related to facility hazards or to safety. Safety analyses should identify the plans, provisions, or compensatory action developed to prevent the limitations of maintenance and repair from degrading safety and should furnish a basis for Departmental review and approval of the adequacy of provisions for maintenance and repair and for compensatory actions for limitations on maintenance and repair. 16 Derivation of Technical Safety Requirements.

a Safety analyses should furnish a logical basis for the comprehensive definition of the acceptable operating envelope for nuclear facilities in compliance with the DOE 5480.TSR, TECHNICAL SAFETY REQUIREMENTS, and the related guidance document. This operating envelope should address all modes of operation and all tests and experiments for which DOE authorization is sought and, as necessary, should accommodate normal operations, maintenance, surveillance, testing, and experiments. Safety analysis should thoroughly explore the safety acceptability of all modes of operation, set points and operational parameters, combinations of inoperable equipment, staffing and qualification levels of operating crews, and limitations of administrative controls to verify that operation anywhere within the envelope will afford adequate safety provisions. Safety analyses should furnish the information necessary to validate, confirm, derive, or modify the bases for TSRs. b The derivations contained in this section should include, for all systems and components to be included in the TSRs, sufficient information to establish the following parameters: i. Safety Limits; ii. Limiting Safety System Settings/Limiting Control Settings; iii. Limiting Conditions for Operation; and iv. Surveillance Requirements. Attachment 1 DOE 5480.23 Page 42 4-10-92 c In addition, information should be provided on related Administrative Controls and the Bases for the values chosen for the above parameters. In addition, the derivation and bases for the facility staffing requirements should be included in this section. d "Technical Safety Requirements constitute an agreement between DOE and the facility's operating management regarding the safe operation of the facility. In this regard, TSRs are taken seriously and cannot be revised without DOE approval. 17 Operational Safety. a The SAR should describe the bases for the Conduct of Operations program required by DOE 5480.19, CONDUCT OF OPERATIONS REQUIREMENTS FOR DOE FACILITIES, and described in the related guidance document. This information should include the following: i. Operations organization and administration; ii. Shift routines and operating practices; iii. Controlled area activities; iv. Communications within the facility; v. Control of onshift training; vi. Notifications and reporting practices; vii. Investigation of abnormal events; viii. Control of equipment and system status; ix. Independent verification practices; x. Operations turnover practices; and xi. Control of operations procedures. b Safety analyses should identify and verify the sufficiency of safe storage and criticality safety requirements for any special nuclear materials to be stored within the bounds of the facility and under the terms of the facility authorization to operate. These analyses should DOE 5480.23 Attachment 1 4-10-92 Page 43 also describe the radiation protection and fire protection programs for the facility and should identify and verify the safety sufficiency of provisions for the control of chemical risks associated with operation, maintenance, surveillance, and emergency response at the facility. 18 Quality Assurance. Safety analyses should contain sufficient information to demonstrate appropriate commitment to a Quality Assurance Program that is required by DOE 5480.6C, QUALITY ASSURANCE REQUIREMENTS, and the related guidance document. a This information should include descriptions of the processes used at the facility for:

i. Design control; ii. Procurement control; iii. Instructions, procedures, and drawings; iv. Document control; v. Control of processes; vi. Inspection, surveillance, and testing control; vii. Control of measuring and test equipment; viii. Handling, storage, and shipping control; ix. Control of nonconforming materials, components, and fabrication/ construction features; x. Corrective actions for identified conditions adverse to quality; xi. Control of personnel training and qualification; xii. Quality improvement; xiii. Quality assurance documents and records; and xiv. Independent quality audits. Attachment 1 DOE 5480.23 Page 44 4-10-92 19 Emergency Preparedness. This SAR section should contain sufficient information to demonstrate appropriate commitment to the emergency planning requirements of the 5500 directive series, as appropriate. The philosophy, objectives, and organization of the emergency preparedness functions should be described for a spectrum of emergencies covering a range from local area emergencies to those that could affect persons off site, as appropriate. The discussion should include activation of emergency organizations, assessment actions, notification processes, emergency facilities and equipment, training and exercises, and recovery actions. This section should also form a basis for the modeling of emergency response, provided that credit is proposed for emergency response in the accident analyses required on page 26, subparagraph (k), of this attachment, and should verify the appropriateness of this modeling. 20 Provisions for Decontamination and Decommissioning. For new facilities and significant modifications of existing facilities, safety analyses should demonstrate, in the design and planning of construction and operation, adequate consideration of the ways the facility may require decontamination and ultimate decommissioning. Final SARs for new and existing facilities should include conceptual plans for decontamination and decommissioning. These plans should demonstrate care in the planning of operations and the evaluation of vulnerabilities to a spectrum of events, including accidents, to avoid unnecessary burdens, to minimize site or environmental contamination that would complicate decommissioning or otherwise limit the ultimate effectiveness of environmental restoration, and to prevent an increase in residual risks during or after decommissioning. (4) "Hazard Classification for DOE Nuclear Facilities and Operations." (Page 13, paragraph 8c of this Order). Contractors responsible for DOE nuclear facilities, and those nonfacility operations not exempted (note Order paragraph 7b(4)) from the requirement to submit an SAR, must prepare an analysis of the hazards of the facility or operation for inclusion in the SAR. Only one use of hazard classification is formally identified in this Order: paragraph 8a ("Graded Approach") of the Order requires that the sophistication of analysis and the thoroughness of documentation of each Safety Analysis Report be proportionate with several factors. One of these factors is the hazard level of the facility. Since the DOE 5480.23 Attachment 1 4-10-92 Page 45 hazard classification of a facility or operation typically governs many aspects of the SAR preparation process, a preliminary hazard assessment should be prepared first and employed in the preparation of the plan and schedule for the SAR as required by page 15, paragraph 9b(2), of this Order. This preliminary hazard assessment should be submitted for DOE review with the plan and schedule. Paragraph 8c introduces the classification scheme for hazard categories. Three hazard categories are defined as follows:

(a) Category 1 Hazard. The hazard analysis shows the potential for significant offsite consequences. (b) Category 2 Hazard. The hazard analysis shows the potential for significant onsite consequences. It should be noted that hazards not included under the above categories would fall under the normal industrial hazards addressed under Occupational Safety and Health regulations. (c) Category 3 Hazard. The hazard analysis shows the potential for only significant localized consequences. It should be noted that hazards not included under the above categoriies would fall under the normal industrial hazards addressed under OSH regulations. (5) "Inventory of Hazardous Materials." (Page 14, paragraph 8c(2) of this Order) (a) One of the requirements for the treatment of hazard analysis in SARs is the documentation of the "inventory enveloping all radioactive and nonradioactive toxic or dangerous materials that are stored, utilized, or may be formed within a nuclear facility." The enveloping inventory is intended to be a commitment. In general, storage or utilization of hazardous materials in quantities greater than this envelope would normally constitute an USQ and must not be done without additional safety analysis and DOE approval. (b) The envelope of hazardous materials may be set at the maximum safe storage capacity of the facility or at the threshold at which the facility would warrant a higher hazard classification, whichever is lower. In this way, it should be unnecessary to modify the safety analysis to accommodate routine changes in the inventory of hazardous materials or to account for trivial quantities. The hazardous material inventory should be explicit as to individual material types and quantities Attachment 1 DOE 5480.23 Page 46 4-10-92 (e.g., number of curies for each radioisotope). Field Office management, with approval from the PSO, may provide guidance to the contractor on the reduction of hazardous material inventory. (6) "Evaluation of Potential Releases." (Page 14, paragraph 8C(3) (a) This paragraph addresses the actual hazard analysis. As this Order indicates, the documentation must include identification of the "energy sources or processes that might contribute to the generation or uncontrolled release of hazardous materials." This listing should be present to document the completeness with which distinct classes of accident scenarios have been explored for hazard analysis and as a resource for accident analysis. These serve to define the boundaries of the safety analysis. It should be noted that a detailed analysis concerning the consequences of accidents affecting all onsite personnel is not required. The discovery that the facility might be subject to an accident scenario not documented in the SAR accident analyses should be evaluated in accordance with DOE 5480.21. If the consequences or likelihood of the newly discovered accident is greater than those of a corresponding accident documented in the SAR, then it should be treated as a USQ. If the newly discovered accident is of different type than any previously analyzed for the facility, then, again, it should be treated as a USQ. If, on the other hand, the newly discovered accident is bounded by the current accident analyses, it would not be treated as a USQ. (b) A conservative, deterministic accident analysis must be performed for hazard classification purposes. It need be no more sophisticated and cover no more scenarios than necessary to identify the hazard classification of the facility. This concept is discussed further in the next section.

(7) Additional guidance for Safety Analysis Reports for facilities of Hazard Category 1. (a) As discussed above, SARs for Hazard Category 1 facilities must be particularly thorough, extensive, and well documented. The following guidance provides the Department's expectations for particular features in safety analyses for facilities of Hazard Category 1. These safety analyses must demonstrate that care has been taken and is being taken to assure that unquestioned premises do not mask important safety DOE 5480.23 Attachment 1 4-10-92 Page 47 problems in management, operations, or the design of the facility. (b) Safety analyses for facilities having one or more Category 1 hazards should include the following features applied to the set of all accident vulnerabilities warranting a Category 1 hazard rating: 1 Deterministic accident analyses consisting of bounding analyses of the consequence of limiting, design basis events, including the postulation of the worst single failure among active engineered safety features, of sufficient variety to fully define appropriate hardware- related TSRs in accordance with DOE 5480. 2 Evaluation of facility risk consisting of realistic analyses of the likelihood-weighted consequences of the spectrum of accident scenarios, including active and passive failures, human errors, multiple failures, common-cause failures, accident phenomenology, source terms, and consequences to the extent necessary to: (a) identify dominant accident sequences; (b) assure effective risk management through design, emergency operating procedures, and accident management programs; (c) grade the stringency of safety commitments in proportion to their importance to risk; (d) form a basis with which to evaluate the risk significance of operational experience; and (e) establish priorities with which to schedule upgrades to facility design and operation. Conservative assumptions may be employed to avoid unproductive expense in the preparation of realistic accident analyses. A formal probabilistic risk analysis that is part of the realistic accident analysis is not required to be included in the SAR. These formal analyses can be referenced and summarized in the report. 3 Human reliability and human factors safety analysis sufficient to: (a) assure the reliable performance of safety related operations, maintenance, surveillance, and emergency response; (b) identify appropriate safety bases for the human-machine interfaces, operations staff qualifications and training requirements, and procedures for operation, maintenance, surveillance, and emergency operating procedures, and appropriate emergency plans for the dominant accident sequences of the facility; and (c) identify and analyze the limitations of the institutional and human factors dimensions of Attachment 1 DOE 5480.23 Page 48 4-10-92 facility safety assurance in the context of the accident sequence vulnerabilities identified in subparagraphs (1) and (2) above.

(8) "Approval of Safety Analysis Reports for new DOE nuclear facilities." (Page 14, paragraph 9a, of this Order). In the sense of being subject to paragraph 9a, all DOE nuclear facilities or operations or SARs are "new" if they do not meet the definition for an "existing" facility or operation in paragraph 9b(1) of this Order. As a practical matter, the distinguishing feature of new versus old is the target date for initial submittal for the most recent SAR. "Initial submittal" refers to the first PSAR or FSAR submitted. It does not refer to revisions to a previously submitted PSAR or FSAR, unless a safety-significant modification is made that is itself new and requires DOE authorization. An SAR is new if it seeks DOE authorization for the project, facility, or operation for the first time. It is a revision that is not new if it seeks to sustain or restore DOE authorization. "Existing" facilities are those that are already in operation or under construction or for which the initial FSAR (or PSAR) is scheduled to be submitted within 12 months after the date of issuance of this Order. SARs for these facilities must be "upgraded" in accordance with paragraph 9b of this Order. Any SAR that is scheduled for initial submittal 12 months or more after the date of issuance of this Order is expected to be submitted in a form that is in full compliance with this Order. In addition, DOE may authorize the contractor in writing to perform limited activities such as procurement of long lead items or preliminary construction (i.e., site preparation) without prior approval of the PSAR or the FSAR. (a) Preliminary Safety Analysis Reports. 1 This Order addresses PSARs for new facilities in paragraph 9a. As previously discussed, PSARs for new facilities are to serve as the principal safety basis for the DOE decision to authorize design, procurement, construction, or preoperational testing. 2 The PSAR required by paragraph 9a may need periodic updating as required to sustain the reliability of the information therein, until such time as it is superseded by an FSAR or the project is mothballed or canceled. This is particularly true for Hazard Category 1 facility projects. The contractor is obligated by this Order to update the PSAR annually, as required, to keep it applicable to the evolving design so that the Department can continue to rely upon the information in the PSAR. DOE 5480.23 Attachment 1 4-10-92 Page 49 3 A PSAR must contain the preliminary design, identify research or other data collection necessary to finalize the design, and document the preliminary approaches to startup and operations management. In addition, a PSAR must contain final commitments by the contractor to the management and oversight of the construction project. These commitments involve the management and organization, management controls and coordination, quality assurance, compliance determination, internal inspection and safety review functions for the procurement, construction, and startup phases of the project. These safety-related construction project commitments and goals will become the basis for DOE safety performance evaluation and compliance assessment during the construction phase of the project.

4 A PSAR must anticipate ways the facility can be constructed, maintained, operated, and shut down safely in compliance with applicable laws and regulations. "Operated" and "maintained," as used here, refers to operation and maintenance in the broadest sense that embraces the full range of operations, testing, surveillance, maintenance, minor modifications, etc. "Shut down" refers to the capability to maneuver the facility into a safe, stable state during routine shutdowns in the event of incidents and accidents and during long-term decommissioning. It also follows that PSARs must identify those laws and regulations that apply to the safety design or operation of the facility. 5 Note that changes can be made in PSAR commitments according to the SAR update process, so that such commitments are not irrevocable. Some changes may be expected to occur as design, procurement, and construction problems are faced and decisions made. It should also be noted that DOE may chose to authorize limited design, procurement, construction, and preoperational testing of facilities without approval of a PSAR. 6 DOE expects, and the language of the paragraph 9a(1) on PSARs in this Order reflects, that nuclear facility construction projects will integrate the planning of operational safety and operations management along with safety design as the project progresses from conceptual design through detailed design, procurement, fabrication, construction, and startup testing. Attachment 1 DOE 5480.23 Page 50 4-10-92 (b) Final Safety Analysis Reports. 1 Paragraph 9a(2) of this Order addresses FSARs. This paragraph of the Order applies only to new facilities. These include safety- significant modifications to existing facilities that require separate DOE authorization to operate. This paragraph addresses FSARs with an initial date of submission to the Department at least 12 months or more after the date of issuance of this Order. Those submitted, or scheduled to be submitted, before that date are covered by paragraph 9b instead of 9a. 2 It should be noted that FSARs contain the principal safety basis for DOE decisions to accept the risk and to authorize facility operations. Once the facility is authorized, FSARs will be among the principal safety bases for sustaining authorization, risk management, and safety oversight. 3 FSARs are to document the adequacy of the safety basis and provide assurance that the facility can be operated, maintained, and shut down safely and in compliance with applicable laws and regulations. This has much the same meaning as does the similar language for PSARs, except that for FSARs, the commitments to operations are expected to be final and fully developed, rather than preliminary. (c) Merged Safety Analysis Reports or Safety Analysis Reports submitted in stages. 1 Paragraph 9a(3) of this Order deals with both merged Preliminary and Final SARs and with SARs that may be submitted in stages. As written, the paragraph merely establishes that DOE may require, in writing, either or both approaches for SARs from a given contractor. 2 DOE may require the preparation and submittal of a single FSAR that combines the roles and contents of a PSAR and an FSAR. DOE has established the option of a combined PSAR and FSAR, which could be used for small, relatively simple facilities. A decision would be made on a case basis, as considered appropriate by DOE. 3 The other option mentioned in paragraph 9a(3), is for phased SARs. Phasing may be done with PSARs, FSARs, or merged/combined PSARs and FSARs.

DOE 5480.23 Attachment 1 4-10-92 Page 51 Submission of SARs in stages could arise in cases when the Department elects to approach the safety review and approval of a new nuclear facility in a sequence of reviews and approvals of portions or phases of the facility. In this case, a SAR must be prepared for each such decision point. Assumptions concerning portions of the facility slated for later safety analysis and approval may be necessary to enable safety analyses of each phase or portion to be completed. Such assumptions about subsequent stages shall be fully identified and structured as commitments to which the successive stages shall adhere, unless directed by the Department. Each contractor charged by the Department with the lead responsibility for the design, construction, or operation of a nuclear facility by means of a staged review and approval process must submit for Department review and approval a detailed plan for the resolution of nonconformances, including a systematic identification of new evidence bearing upon the validity of prior safety analysis. Each of the safety analyses prepared under the staged preparation provisions of this paragraph shall incorporate or reference safety analyses of prior portions or phases, so that each SAR fully covers all design, construction, and operational considerations, commitments, and conditions of approval as the project progresses. (9) "Preparation and Submittal of upgraded Safety Analysis Reports for existing DOE nuclear facilities." (Page 15, paragraph 9b of this Order) (a) The requirements for SARs for existing facilities, established in paragraph 9b are essentially the same as those for new facilities in paragraph 9a, except for the way the new requirements are phased in. There is a fixed date after which any SAR submitted for a new facility must be in full compliance with this Order. For existing nuclear facilities, this Order requires the establishment of an SAR upgrade plan and schedule, in accordance with the requirements of paragraph 9b, subject to DOE approval. This approach is intended to encourage a well-prioritized sequence of partial upgrades for the FSARs for the many existing DOE nuclear facilities, so that the most important safety issues may be dealt with first. (b) The language of this Order makes a distinction between safety analyses and SARs in this context. Contractors can and should avail themselves of the preliminary Attachment 1 DOE 5480.23 Page 52 4-10-92 results of safety analyses before the documentation of SAR upgrade modules is complete, particularly for planning and management purposes. "Upgrading" as used here is distinct from "updating" SARs; it means updating and more. The program for upgrading SARs for existing facilities involves updating prior FSARs so that they address the current safety basis of the facility, rather than the safety basis at the time such facilities were originally authorized or last analyzed; and bringing the SARs for existing facilities (and designated operations) into compliance with the requirements of this Order. (c) DOE expects operating contractors to develop a new safety basis for existing facilities that is broader in scope than the traditional concept of the safety design basis. It should not be constrained to the initial safety design or design bases as they were conceived at the time the SAR was prepared or last updated. The new safety basis, like that for a new facility, should logically follow from generic goals, objectives, and constraints as mention in the SAR. The context of current safety analysis capabilities, based on adapted facility design, site selection, and planned future operation, shall fall within statutes, Federal rules, and DOE Directives.

(d) Generally, it is unnecessary and inappropriate to develop the new safety basis for an existing facility as one would for a new facility. The investment in the existing facility should be recognized. The new safety basis should be developed to yield high levels of safety assurance expected today at minimum cost and with minimum disturbance to existing designs, thus avoiding unnecessary or unproductive expense in retrofitting facilities. [The new safety basis for existing facilities must strike a balance in which low residual risks and high confidence in safety are achieved with minimum costs and delays.] (e) To illuminate the balance DOE is seeking, consider the case of engineering codes and standards. An upgraded safety analysis for an existing nuclear facility of Hazard Category 1 (for which particularly thorough safety analysis is required) should explore the hypothesis that the original commitments to engineering codes and standards may be inadequate. It is not, however, automatically necessary to adopt the most recent engineering codes and standards, particularly if doing so would require that the facility be rebuilt. Instead, the upgraded safety analysis should explore whether the use of an older code or standard might give DOE 5480.23 Attachment 1 4-10-92 Page 53 rise to an accident vulnerability that could compromise facility safety. If there is no such vulnerability, the issue is closed by this assessment. If there is such a vulnerability, then a method for correcting, eliminating, or compensating for the vulnerability should be sought that is adequate to protect individual health and the environment. For example, it is reasonable to make more use of active safety features, administrative controls, and/or accident management strategies to limit the risk of existing facilities that would be applied to a new design because of the broader range of potentially cost-effective safety design options available with a new facility. If, however, more reliance is placed on operators to undertake accident management strategies, then safety analyses for Hazard Category 1 facilities should verify that this reliance is warranted and credible. Human reliability analysis, and the assessment of the human factors surrounding the reliability of such human actions, should be employed to determine whether such dependence on operators is realistic, yields the expected limitation of risk, and does not produce unexpectedly high human error rates due, for example, to overloading operators under accident conditions. (f) Paragraph 9b(1) refers to SARs rather than FSARs or PSARs. As such, it applies not only to Final SARs, but also to PSARs for those facilities that meet the criterion of having an "existing" PSAR at the time this Order is approved (i.e., one scheduled for submittal within 12 months after the date of issuance of this Order). (10) "Plan and Schedule for Safety Analysis Reports." (Page 15, paragraph 9b(2), of this Order) (a) Paragraph 9b(2) of this Order requires each contractor responsible for performing a safety analysis or submitting an SAR to develop what is, in effect, a transition plan for compliance with this Order. (b) The "overall plan" developed by each operating contractor and required by paragraph 9b(2) of this Order should address the management and budgeting of the FSAR upgrade program for all existing DOE nuclear facilities for which the contractor is responsible. The plan should describe the mechanisms established for internal and external review and approval of detailed plans and schedules for the FSAR upgrade products. The plan should identify the methods to be employed in determining priorities with which to schedule individual

Attachment 1 DOE 5480.23 Page 54 4-10-92 facility FSAR upgrade modules. In paragraph 9b(2), it is indicated that DOE approval of the upgrade plan and schedule is required. However, in recognition of the potential need for changes, provision is made to amend either the plan or the schedule, subject to DOE approval. (c) For existing facilities and operations, this Order requires specific information to be present in the overall management plan and schedule, in addition to the principal requirement that the submittal delineate high- level plans and major milestones for bringing SARs into compliance. These additional requirements consist of "preliminary assessment of facility hazards, the basis for the content, schedule, and level of detail proposed, bases for interim operation or restrictions on interim operations, and administrative controls during the upgrade process." (d) A preliminary hazard assessment must be submitted because hazard classification governs the requirements for length and thoroughness of SARs. Thus, the hazard classification must be known, or at least estimated, before SAR upgrade planning at a facility-specific level can go very far. The preliminary hazard assessment is intended primarily to assess whether prior facility hazard classifications may need to be changed and SAR planning and prioritizing be carried out accordingly. (e) It is expected that the overall plan and schedule will identify how, if at all, SAR upgrades for some or all facilities will be divided into phases. The plan will also include, for DOE's review and approval, the prioritization scheme, since the basis for deciding which facility's SARs will be upgraded first, second, etc., and how the SAR upgrade phases are to be sequenced. (f) Next, the language quoted above calls for the plan and schedule to include "the level of detail proposed." Each contractor must propose the level of effort, the sophistication of analysis, and the thoroughness of documentation planned for upgrading the SARs for each of the existing facilities and operations. This might be done by submitting an annotated outline of the proposed SAR for each facility and by delineating criteria for length and thoroughness of analysis and documentation. These proposals are subject to review and approval by DOE. It should be recognized that these proposals are subject to change if justified based upon new information, such as a change in hazard classification DOE 5480.23 Attachment 1 4-10-92 Page 55 or the discovery of new safety issues while the SAR upgrade is under way. (g) Paragraph 9b(2) of this Order calls for "bases for interim operation or restrictions on interim operations, and administrative controls during the upgrade process." The question of a satisfactory basis for approving continuing operation should be addressed in the overall management plan submittal. The contractor may propose constraints on interim operation for DOE review as part of the SAR upgrade planning. In some cases, contractors may also recommend that a facility be shut down, or remain shut down, during the SAR upgrade process. These are appropriate subjects for the overall plan and schedule submitted in compliance with paragraph 9b(2) of this Order. In addition to contractor proposals in this regard, DOE may take separate actions to restrict, modify, or shut down operations at a facility.

(h) The last portion of the words quoted from paragraph 9b(2) of this Order addresses administrative controls. An important aspect of these ground rules for interim operation, and one DOE must review and approve, comprises the administrative controls and institutional safety assurance features that the contractor proposes to implement to support interim operation of the existing facilities during the SAR upgrade process. At the facility-specific level, these ground rules center on the administrative controls normally found in technical specifications or operational safety requirements, and include minimum shift staffing and qualification of personnel, operations planning, surveillance and maintenance, and related operational safety practices. (i) Some facilities will not warrant an early FSAR upgrade. Those shut down indefinitely, or those scheduled for retirement in the very near future, may be candidates for deferred analysis or no analysis other than decommissioning plans, monitoring, environmental remediation, or other activities that differ from normal facility operations. Other facilities may warrant an SAR upgrade, but with so low a priority that the upgrade may be deferred for some time while more pressing SAR upgrades are undertaken. Proposals for handling these cases should also be part of the submittal made with the management plan and schedule. (j) DOE recognizes that programs to upgrade nuclear facility SARs are already under way at many DOE operating contractors. In some cases, this Order will require Attachment 1 DOE 5480.23 Page 56 4-10-92 that some recently revised and updated SARs be modified. DOE will accept prior SARs and SAR upgrades to the extent that they cover the subject matter and fulfill the technical requirements of this Order. However, some additions or clarifications of prior SARs may be necessary, in particular to meet the required institutional and human factors safety analysis requirements. (k) This Order does not specify how the phases of FSAR upgrading are to be structured to give maximum flexibility for contractor proposals that will require DOE approval. DOE does not intend to change existing plans or recent FSAR upgrades merely to conform to an arbitrary pattern. Only if changes are needed to accomplish the fundamental purposes of the safety analysis process does the Department mean to require revisions to ongoing or recently completed FSAR upgrades. One example of an FSAR upgrade program is as follows: Phase 1: Preparation of the overall management plan, budget, and estimated major milestone schedule to be submitted within 6 months of the date of issuance of this Order. Attached to it are: (a) the identification of a basis for interim operation and, if necessary, restrictions and/or administrative controls on interim operations; (b) an initial hazard assessment, including a critique of the existing hazard classification of the facility and its documentation in light of the requirements of this Order; (c) an assessment of the priority; and (d) a detailed plan and schedule for Phase 2 for each facility FSAR update. Phase 2: Reassess the facility hazard classification. Prepare the section of the upgraded FSAR dealing with the facility hazard or hazards. Critique the existing body of safety commitments (including technical specifications, operating safety limits, etc.) and the bases for them in prior safety analyses in light of the requirements of DOE 5480.SAR. Prepare a detailed plan and priority assessment for proceeding with Phase 3 of the FSAR update for the facility.

DOE 5480.23 Attachment 1 4-10-92 Page 57 Phase 3: Develop a renewed basis for and content of safety commitments in compliance with this Order, including bases for DOE safety related inspection and enforcement. Critique existing safety analysis documentation with respect to meeting the other purposes and content criteria for FSARs identified in this Order. Develop priorities for further refinements of the FSAR toward the standards set for new facilities. Propose a schedule for Phase 4 upgrades and a rationale for any proposal to defer indefinitely any upgrade element. Phase 4: Complete the updating of the analyses and documentation for the facility FSAR. Issue final rationale for those elements expected in an FSAR for a similar new facility for which it is determined that an FSAR upgrade is not justified. (l) The above example of an FSAR upgrade program does not mean to imply that this approach is the only one acceptable. The Department is open to suggestions for alternative approaches. (m) Unless the contractor is otherwise directed on a case-by-case basis, the Department is encouraging major FSAR upgrades in stages to address the most pressing safety issues first, facilitate interim review and approval of partial FSAR upgrades, and permit optimum use of available resources. Each of several FSAR upgrade phases for each of the DOE nuclear facilities operated by one contractor and sharing a common pool of resources for FSAR upgrades (personnel to perform the analyses as well as financial resources) are subject to sequencing according to priority as proposed by the contractor and approved by DOE. (n) One of the first considerations in setting priorities for FSAR upgrades is the magnitude of the facility hazard (i.e., the range of potential risk). Risks to the health and safety of the public are the most important risk factors, with additional consideration given to the risks of incremental environmental contamination and risks to the work force on the DOE reservation. In each case, it is the interim risk during the upgrade that is to be considered when setting priorities and taking compensatory actions for FSAR upgrades. No formal quantification of risk is anticipated for prioritization purposes: expert Attachment 1 DOE 5480.23 Page 58 4-10-92 judgment, conservatively applied, is sufficient. When more objective safety analysis results materialize as the upgrade progresses, this information should be employed to prioritize remaining SAR upgrade tasks. (o) A second major consideration in judging the priorities of FSAR upgrades is the need to develop renewed safety basis for interim operation or, if necessary, to define the contents of and bases for restrictions on interim operation while the program to upgrade safety analyses is under way. In other words, if there are two facilities of roughly equal potential risk, and one has a better basis for justifying interim operation than the second, then the other should be given priority for an earlier upgrade of the FSAR, at least for the phase of the upgrade dealing with the identification of a better basis for safety commitments. Likewise, if one appears to need restrictions on interim operation while another does not, the one needing restrictions would tend to draw the higher priority for FSAR upgrading.

(p) A third major consideration in judging the priorities for FSAR upgrades is the need to strengthen the bases for, or contents of, the safety basis for the facility and the corresponding commitments under which the nuclear facilities are operated after the upgrade is completed. As a result of the broadened conception of safety basis and commitments in this Order, virtually all DOE nuclear facilities will need a more comprehensive safety basis and/or content of safety commitments. (q) A final consideration in judging the priorities of competing FSAR upgrade projects lies in the importance of the mission and of continued operation of the facility. If a facility has a particularly important mission, an interim shutdown or restriction on operation while the FSAR upgrade was under way could be an important incentive to expedite the upgrade. Even if it is determined that interim operation without restriction is justified, it may be in the national interest to expedite the safety analysis of a facility for which the extra confidence could be important to long- term mission success. (11) Periodic updates of Safety Analysis Reports. (Page 16, paragraph 9c of this Order) (a) Paragraph 9c addresses periodic updates for SARs. Updates are distinct from upgrades addressed in paragraph 9b of this Order. "Upgrades" refer to the changes that must be made in SARs to bring them into conformance with this Order. "Updates," on the other hand, refer to DOE 5480.23 Attachment 1 4-10-92 Page 59 the amendments to SARs that are necessary to keep them current. The process of updating SARs must be a continuing process so long as the subject facility has not been fully decommissioned. (b) Paragraph 9c requires that SARs be amended periodically "to ensure that the information in each SAR is current and remains applicable." This requirement is in recognition that changes occur in both facility conditions and the level of knowledge regarding safety analysis, as well as new information. However, if changes to facility conditions and the knowledge level has not changed or no new information has developed during the period of review then changes to the SAR are not necessary. (c) Paragraph 9c applies only to SARs "submitted pursuant to this Order." Prior SAR material only becomes subject to the requirements of paragraph 9c if and when such material is resubmitted or referenced pursuant to paragraph 9b(2). These words "submitted pursuant to this Order" have been inserted into the Order to avoid unproductive effort to update SAR material before it has been upgraded in general to bring it into conformance with this Order. As a result, the requirement to update SARs takes effect only when an existing SAR (or part of it) has been upgraded in accord with paragraph 9b(2). Any part of an SAR that has been upgraded, however, is immediately subject to paragraph 9c because situations may arise in which part of a facility FSAR has been upgraded for long enough to require updating even though other parts of the same facility FSAR have yet to be upgraded and are exempt from the updating requirement. (d) FSARs for existing facilities must undergo a phased upgrade under paragraphs 9b(1) and 9b(2) of this Order. As a result, for older facilities, questions may arise concerning which FSAR must be updated and when. Old FSAR material is not subject to updating under paragraph 9c unless and until it is incorporated into the phased FSAR upgrade program. The following guidelines are provided:

1 New FSAR upgrade modules prepared to comply with paragraph 9b(1) for existing facilities and submitted 12 months or more after the date of issuance of this Order must be updated thereafter, as necessary, to be consistent with the as-built, Attachment 1 DOE 5480.23 Page 60 4-10-92 as-operated facility and to reflect new information or safety analysis techniques. 2 Any portions of older FSAR material that is referenced or otherwise used to fulfill the requirements of this Order for an upgraded FSAR must be updated thereafter, as necessary, to be consistent with the as- built, as-operated facility. 3 For all portions of older FSAR material that is scheduled to be upgraded or superseded as part of the phased FSAR upgrade process, the schedule for the upgrade process is the controlling factor and no annual updates are required. The Department may, however, on a case basis specifically request that such FSAR material be updated. 4 Major, safety-significant modifications of existing facilities are treated as though they were new facilities, including the requirement to keep their SARs up-to-date. (e) Paragraph 9c requires an annual update for all SARs submitted pursuant to this Order. DOE has chosen to employ the annual update requirement even for small, inactive, and/or low-hazard facilities or operations to ensure an annual review in every case. This is to ascertain that changes in design or operation have not occurred that should be subject to reportage and/or safety analysis, or that new information warrants a new look at the safety basis for the facility or operation. In some cases, actual modifications to the SAR may not be necessary based on this annual revision. The responsible contractor can provide annual SAR updates by: 1 Certifying that the existing SAR remains fully applicable; 2 Providing supplements or amendments for DOE approval to bring the SAR up-to-date; or 3 Submitting a SAR for DOE approval that is proposed to supersede the current SAR. (f) DOE expects that updates of SARs for facilities in operation for 12 months or more will address the results of the experience feedback program for that facility as well as relevant experience from other facilities, both within DOE and from the commercial nuclear industry, as that experience reflects upon the safety profile of the facility. All such relevant information bearing on or shedding light on the safety profile of the DOE 5480.23 Attachment 1 4-10-92 Page 61 (and 62) facility should be examined as part of the update. DOE also expects that relevant research results at nuclear facilities will be evaluated relative to the safety of each DOE nuclear operation as part of the updating of that facility's SAR. (g) One category of FSAR is exempt from the requirement for annual updates. Once DOE has approved the decommissioning of a facility, and the decommissioning has been carried to completion, then the FSAR prepared to support DOE authorization for decommissioning need no longer be subject to annual updating. (12) Document control. (Page 14, paragraph 8d of this Order). The principal thrust of this paragraph is to require that DOE's operating contractors take responsibility for ensuring that copies of the SAR in circulation are up-to-date. It reflects, in part, the obligation identified elsewhere in this Order that a formal mechanism will exist to ensure that SARs contain reliable information, that SARs must be updated as necessary to sustain that reliability, and that the circulation of amendments, revisions, updates, packages of replacement pages, or new SARs is sufficiently controlled that users throughout DOE and its oversight groups have, or have ready access to, the most recent, up-to-date editions. Paragraph 8d of this Order requires an effective and formalized document control system for any current SAR.

DOE 5480.23 Chg 1 U.S. Department of Energy PAGE CHANGE Washington, D.C. 3-10-94 SUBJECT: NUCLEAR SAFETY ANALYSIS REPORTS 1. PURPOSE. This Page Change transmits the revised pages to DOE 5480.23, NUCLEAR SAFETY ANALYSIS REPORTS, of 4-10-92. 2. EXPLANATION OF CHANGE. Formalization of nuclear safety facility authorization is added to the “Responsibilities and Authorities” paragraph of the Secretarial Officers. Also, the definition of “authorization basis” (from DOE 5480.21) is added. 3. FILING INSTRUCTIONS. a. Remove Pages Dated Insert Pages Dated 3 and 4 4-10-92 3 3-10-94 4 4-10-92 7 and 8 4-10-92 7 3-10-94 8 4-10-92 b. After filing the attached pages, this transmittal may be discarded. BY ORDER OF THE SECRETARY OF ENERGY: ARCHER L. DURHAM Assistant Secretary for Human Resources and Administration DISTRIBUTION: INITIATED BY: All Departmental Elements Assistant Secretary for Environment, Safety and Health